Federal Housing Finance Agency Print

 Advisory Bulletins

 

 

Enterprise Cybersecurity Incident Reporting27878Fannie Mae & Freddie Mac8/21/2020 4:00:00 AMAB 2020-05<table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width&#58;100%;"><p> <strong>​ADVISORY BULLETIN</strong></p><p> <strong>AB 2020-05&#58; ENTERPRISE CYBERSECURITY INCIDENT REPORTING</strong></p></td></tr></tbody></table><p> <em style="text-decoration&#58;underline;"> <em> <strong>​Purpose</strong></em></em></p><p>This advisory bulletin (AB) communicates Federal Housing Finance Agency's (FHFA) supervisory expectations for cybersecurity incident reporting to maintain safe and sound operations at Fannie Mae and Freddie Mac (the Enterprises). <a href="#footnote1"> <span style="text-decoration&#58;underline;">[1]</span></a></p><p style="text-decoration&#58;underline;"> <strong> <em>Background</em></strong></p><p>As part of an effective information security management program, the Enterprises need to be able to effectively respond to cybersecurity events that could affect the confidentiality, availability, and integrity of information. &#160;The continuous monitoring of systems to detect anomalies as well as successful and attempted attacks, including unauthorized activity on or intrusion into information systems, is an activity that underlies robust incident response.</p><p>Prioritizing the handling of cybersecurity incidents is a critical factor in the success or failure of an incident response process. By prioritizing incidents, Enterprises identify situations that are of greater severity and demand immediate attention.&#160; The Enterprises should communicate to FHFA incidents that affect or have the potential to affect the security of their information.&#160; This AB informs the Enterprises of supervisory expectations for assessing the Enterprise reports on cybersecurity incident data sent to FHFA.</p><p style="text-decoration&#58;underline;"> <em> <strong>Guidance</strong></em></p><p>This guidance explains the need for cybersecurity incident information that is supplemental to what is otherwise regularly, consistently, and systematically collected for use in supervisory oversight.&#160; The information reported in line with this guidance is adjunct to other more formal reports, but it is important for both the Enterprises and FHFA to compile and use the information specifically in evaluating cybersecurity incident responses and readiness to confront cybersecurity threats to safety and soundness.</p><p> <em>Definition of Cybersecurity Incident</em></p><p>For the purpose of the AB, FHFA defines a reportable cybersecurity incident as an occurrence that&#58;</p><ul><li>occurs at the Enterprise or at a third party that actually or potentially jeopardizes the confidentiality, integrity, or availability of an Enterprise system or Enterprise information the system processes, stores, or transmits, or;</li><li>constitutes a violation or imminent threat of violation of the Enterprise's security policies, security procedures, or acceptable use policies. <a href="#footnote2"> <span style="text-decoration&#58;underline;">[2]</span></a></li></ul><p> <em>Incident Severity Scoring</em></p><p>Effective reporting of cybersecurity incidents begins with the Enterprises determining a cybersecurity incident's severity by evaluating the confirmed impacts as well as potential impacts of the incident that they anticipate are likely to occur. Outlined below is an Incident Severity Score framework that will be consistent in meaning across both Enterprises and will facilitate the Enterprises' accurately advising FHFA of the seriousness of each incident. <a href="#footnote3"> <span style="text-decoration&#58;underline;">[3]</span></a>&#160; As analysis of a cybersecurity incident progresses, the Enterprises should continuously re-evaluate the severity level for each incident and report to FHFA as described below.</p><p> <strong>Severity 1&#58; Major.</strong>&#160; Cybersecurity incidents that interrupt one or more mission critical functions or result in the inability to achieve one or more mission critical objectives.&#160; Major Incidents are likely to have a substantial negative impact on customers and/or counterparties and may pose reputational risk to the Enterprise.&#160; Cybersecurity incidents that include personally identifiable information may also be considered a Major Incident.&#160; </p><p> <strong>Severity 2&#58; Significant.</strong>&#160; Cybersecurity incidents that interrupt or result in a degradation to one or more mission critical functions or core services.&#160; Significant Incidents may have a negative impact on customers and/or counterparties and may pose reputational risk to the Enterprise.&#160; Cybersecurity incidents that include substantial non-public information may also be considered Significant Incidents.</p><p> <strong>Severity 3&#58; Moderate.</strong>&#160; Cybersecurity incidents that interrupt or result in a degradation to one or more production systems or applications.&#160; Moderate Incidents may have a negative impact on customers and/or counterparties but are unlikely to pose substantial reputational risk to the Enterprise.&#160; Cybersecurity incidents that include a moderate amount of non-public information may also be considered Moderate Incidents.</p><p> <strong>Severity 4&#58; Minor.</strong> &#160;Cybersecurity incidents that result in a degradation to a production system or application or an outage of multiple non-production systems or applications.&#160; Minor Incidents are unlikely to have negative impact on customers and/or counterparties and pose no reputational risk to the Enterprise.&#160; Cybersecurity incidents that include minor amounts of data loss may also be considered.&#160; Minor Incidents may result in minor amounts of data loss that cannot be retrieved or deleted.</p><p> <strong>Severity 5&#58; Insignificant.</strong>&#160; Cybersecurity incidents that interrupt or result in an outage of a single non-production system or application or the degradation of one or more non-production systems or applications.&#160; Insignificant Incidents may also include a violation of security policies, security procedures, or acceptable use policies that has no impact on systems and applications.&#160; Insignificant Incidents are unlikely to have a negative impact on customers and/or counterparties and pose no reputational risk to the Enterprise.&#160; Cybersecurity incidents that include minor amounts of data loss that can be retrieved may also be considered Insignificant Incidents.</p><p> <em>Timely Reporting&#160;</em></p><p>Timely reporting from each Enterprise is critical to effective supervision.</p><p> <strong>Immediate Notification</strong></p><p>FHFA expects the Enterprises to prioritize responding to, and taking corrective action for, the identified incident or potential threat and to notify and provide a description of any Major Incident as soon as possible to the Examiner-in-Charge (EIC) for the Enterprise.&#160; The notification can occur via email, telephone, or in person so long as the Enterprise confirms receipt of the notification.&#160; In addition to contacting the EIC, the Enterprise should send a report describing the Major Incident to FHFA through secure methods established by FHFA.&#160; The Enterprise should continue to provide updates on any Major Incident throughout the incident response and remediation to the EIC or his/her designee.</p><p> <strong>24-hour Notification</strong></p><p>FHFA expects the Enterprises to notify and report a description of any Significant Incident within 24 hours of determination.&#160; The notice and report should be made to the EIC for the Enterprise.&#160; The notification can occur via email, telephone, or in person so long as the Enterprise confirms receipt of the notification.&#160; In addition to contacting the EIC, a report of any Significant Incident should be sent electronically through secure methods established by FHFA.&#160; The Enterprise should continue to provide updates on any Significant Incident throughout the incident response and remediation to the EIC or his/her designee.&#160;</p><p> <strong>Monthly Cybersecurity Incident Report</strong></p><p>Consistency of incident reporting is necessary to assess the effectiveness of each Enterprise's incident response process.&#160; Threats may occur simultaneously, sequentially, or randomly and FHFA needs to be sufficiently informed of incidents to evaluate effective detection and responses across the Enterprises. By submitting a monthly cybersecurity incident report to FHFA, the Enterprises and FHFA will be better prepared and aware of security challenges that could compromise safety and soundness.&#160; FHFA will provide a template describing the format as well as the standard content with corresponding definitions and examples that should be included in the monthly cybersecurity incident report.</p><p>Each Enterprise should submit the monthly cybersecurity incident report within fifteen (15) calendar days after the end of each month, even if there are no reportable cybersecurity incidents during the reporting period.&#160; The report should be sent electronically through secure methods established by FHFA.</p><p style="text-decoration&#58;underline;"> <strong><em>Effective Date</em></strong></p><p>This AB becomes effective on October 1, 2020</p><p style="text-decoration&#58;underline;"> <strong><em>Related Guidance</em></strong></p><p style="text-align&#58;left;">12 CFR Part 1236 Prudential Management and Operations Standards, Appendix.&#160;<em>&#160;</em></p><p style="text-align&#58;left;"> <em>Oversight of Third-Party Provider Relationships</em>, Federal Housing Finance Agency Advisory Bulletin 2018-08, September 28, 2018.&#160;</p><p style="text-align&#58;left;"> <em>Cloud Computing Risk Management</em>, Federal Housing Finance Agency Advisory Bulletin 2018-04, August 14, 2018.&#160;</p><p style="text-align&#58;left;"> <em>Information Security Management</em>, Federal Housing Finance Agency Advisory Bulletin 2017-02, September 28, 2017.&#160;</p><p style="text-align&#58;left;"> <em>Internal Audit Governance and Function</em>, Federal Housing Finance Agency Advisory Bulletin 2016-05, October 7, 2016.&#160;</p><p style="text-align&#58;left;"> <em>Data Management and Usage</em>, Federal Housing Finance Agency Advisory Bulletin 2016-04, September 29, 2016.&#160;</p><p style="text-align&#58;left;"> <em>Operational Risk Management</em>, Federal Housing Finance Agency Advisory Bulletin 2014-02, February 18, 2014.<br>&#160;</p><hr width="25%" align="left" /><p> <a name="footnote1"> <span style="text-decoration&#58;underline;">[1]</span></a>&#160;Common Securitization Solutions, LLC (CSS) is an “affiliate&quot; of both Fannie Mae and Freddie Mac, as defined in the Federal Housing Enterprises Financial Safety and Soundness Act of 1992, as amended.&#160; 12 USC 4502(1).</p><p> <a name="footnote2"> <span style="text-decoration&#58;underline;">[2]</span></a>&#160;This definition is adapted from the National Institute of Standards and Technology. </p><p> <a name="footnote3"><span style="text-decoration&#58;underline;">[3]</span></a><em>&#160;</em>The Incident Scoring is not meant to replace severity or priority scoring established internally by the Enterprises.</p><p> <em>&#160; </em></p> <em> <table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width&#58;100%;"><p>FHFA has statutory responsibility to ensure the safe and sound operations of the regulated entities and the Office of Finance. Advisory bulletins describe FHFA supervisory expectations for safe and sound operations in particular areas and are used in FHFA examinations of the regulated entities. Questions about this advisory bulletin should be directed to <a href="mailto&#58;SupervisionPolicy@FHFA.gov">SupervisionPolicy@FHFA.gov</a>. </p></td></tr></tbody></table> <p>&#160;</p></em>8/24/2020 5:00:30 PMHome / Supervision & Regulation / Advisory Bulletins / Enterprise Cybersecurity Incident Reporting Advisory Bulletin AB 2020-05: ENTERPRISE CYBERSECURITY INCIDENT REPORTING 1666https://www.fhfa.gov/SupervisionRegulation/AdvisoryBulletins/Pages/Forms/AllItems.aspxhtmlFalseaspx
Financial Reporting and Disclosure and External Audit28435All8/20/2020 4:00:00 AMAB 2020-04<table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width&#58;100%;"><p> <strong>​ADVISORY BULLETIN</strong></p><p> <strong>AB 2020-04&#58; FINANCIAL REPORTING AND DISCLOSURE AND EXTERNAL AUDIT</strong></p></td></tr></tbody></table><p> <em style="text-decoration&#58;underline;"><em><strong>​Purpose</strong></em></em></p><p>This Advisory Bulletin (AB) articulates the Federal Housing Finance Agency's (FHFA) supervisory expectations for oversight and management of financial reporting and disclosures and of the external audit function. </p><p>This AB applies to Fannie Mae and Freddie Mac (the Enterprises), the Federal Home Loan Banks (FHLBanks), and the FHLBanks' Office of Finance (OF) (collectively, the regulated entities) <a href="#footnote1"> <span style="text-decoration&#58;underline;">[1]</span></a> and is effective immediately. &#160;This AB rescinds, and along with AB 2016-05 Internal Audit Governance and Function, replaces FHFA's Examination for Accounting Practices guidance.&#160; </p><p>Transparent financial reporting and disclosures, subject to strong internal control over financial reporting (ICFR) and confirmed by a high-quality external audit, help ensure that published financial information is reliable and free from material misstatements for all stakeholders.&#160; &#160;&#160;Timely, accurate, complete, and meaningful reporting and disclosures regarding financial condition and performance support FHFA's risk-focused supervision of the regulated entities.&#160; For FHFA as a prudential regulator, such reporting facilitates effective risk assessments, off-site monitoring, and examination planning. &#160;Financial condition and performance metrics for capital adequacy, liquidity, earnings adequacy, and asset quality are based on information in these reports.</p><p style="text-decoration&#58;underline;"> <strong><em>Background</em></strong></p><p>The Office of Federal Housing Enterprise Oversight (OFHEO) issued the Examination for Accounting Practices guidance to the Enterprises in 2006. &#160;FHFA revised and updated that guidance in 2009 and expanded its application to the FHLBanks. &#160;With the issuance of this financial reporting and external audit guidance and AB 2016-05 Internal Audit Governance and Function, FHFA has updated and revised the 2009 guidance to reflect our regulatory experience and that of other financial regulators, and to more clearly communicate FHFA's supervisory expectations in these areas to the regulated entities.&#160;</p><p>Regarding financial reporting and external audit, the regulated entities are governed by different, yet generally concordant, FHFA and/or Securities and Exchange Commission (SEC) regulations and auditing standards. <a href="#footnote2"> <span style="text-decoration&#58;underline;">[2]</span></a>&#160; Notably&#58;&#160;</p><ul><li>The Enterprises are SEC registrants. Their external audits are subject to Public Company Accounting Oversight Board (PCAOB) auditing standards.&#160; Under FHFA regulations, the Enterprises are subject to specified New York Stock Exchange (NYSE) requirements.</li><li>The FHLBanks are SEC registrants.&#160; Their external audits are subject to PCAOB auditing standards and under FHFA regulations, are subject to Generally Accepted Auditing Standards (GAAS) and Generally Accepted Government Auditing Standards (GAGAS). <a href="#footnote3"> <span style="text-decoration&#58;underline;">[3]</span></a>&#160; Applicable FHFA rules further detail specific requirements for audit committees regarding external audit and financial reporting oversight.</li><li>The OF is not an SEC registrant.&#160; Under FHFA regulations, FHLBank System combined financial reports are subject to GAAS and GAGAS. <a href="#footnote4"> <span style="text-decoration&#58;underline;">[4]</span></a>&#160; The regulations also address oversight of the external auditor for the combined financial reports. <a href="#footnote5"> <span style="text-decoration&#58;underline;">[5]</span></a></li></ul><p>Each Enterprise and FHLBank is covered by FHFA's Prudential Management and Operations Standards (PMOS) and each regulated entity reports financial information in conformance with U.S. Generally Accepted Accounting Principles (GAAP). <a href="#footnote6"> <span style="text-decoration&#58;underline;">[6]</span></a>&#160; Enterprise and FHLBank management assess the effectiveness of their respective entity's ICFR based on the criteria in the Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).&#160;</p><p>The referenced FHFA, SEC, and NYSE rules and regulations, as applicable, address a wide range of audit committee governance topics including&#58;&#160;</p><ul><li>Committee composition and members' qualifications, including financial literacy and expertise, and independence requirements;</li><li>Committee oversight of the integrity of financial statements and earnings releases and compliance with legal and regulatory requirements;</li><li>Committee charter content and minimum frequency of reviews and re-approval;</li><li>Boards' responsibility to provide the audit committee sufficient funding for payments to the external auditor and to advisors/counsel that the committee retains as it deems necessary to carry out its duties;</li><li>Committee duties and responsibilities regarding external auditor oversight including&#58;</li><ul><li>Responsibility for selecting the auditor, evaluating the auditor's performance, replacing the auditor if needed, and ensuring that the auditor is solely responsible to the committee;</li><li>Ensuring that the external auditor submits a formal written statement regarding relationships and services that may adversely affect independence and discussing any disclosed relationships that may impact objectivity and independence with the external auditor;</li><li>Reviewing the auditor's internal quality control procedures;</li><li>Meeting with, including in executive sessions, auditors and management;</li><li>Reviewing and approving procedures for handling complaints received by the regulated entity regarding accounting, internal accounting controls, or auditing matters; and confidential, anonymous submission by regulated entity staff of concerns regarding questionable accounting or auditing matters; and</li><li>Providing for an annual committee self-evaluation or external review.</li></ul></ul><p>The guidance in this AB is intended to be consistent with applicable statutes, regulations, GAAP, and auditing standards.&#160; In some instances, substantive elements of guidance herein for all regulated entities may be addressed by FHFA regulation, SEC regulation, or applicable accounting or auditing standards for one or more regulated entities.&#160; This guidance does not relieve or diminish the responsibility of a regulated entity's board of directors or management to follow applicable laws, rules, and regulations and to conform to applicable accounting standards.&#160; Any perceived conflicts should be resolved so as to comply with applicable laws and regulations, and in conformance with accounting standards.</p><p style="text-decoration&#58;underline;"> <em><strong>Guidance</strong></em></p><p> <strong>I. Financial Reporting and Disclosure Oversight and Management</strong></p><p>Regulated entities' boards of directors and senior managers are responsible, within their respective roles as described in FHFA's corporate governance regulation and prudential standards, for the institution operating in a safe and sound manner. &#160;Entities should maintain effective accounting and reporting systems and ICFR to produce reliable and accurate financial reports and meaningful disclosures.&#160;</p><p>To address accounting, financial reporting, and disclosure, audit committees should&#58;&#160;</p><ul><li>Review and discuss annual audited financial statements, quarterly SEC filings or equivalent financial statements, and earnings releases;</li><li>Meet regularly with management and external auditors and hold regular executive sessions with the external auditor;</li><li>Oversee that management establishes, implements, and maintains accounting policies and procedures that comply with applicable laws, rules, and regulations and conform to applicable guidance, including GAAP and other relevant reporting and disclosure standards;</li><li>Ensure that the regulated entity has policies in place to notify FHFA of any accounting treatments or policies identified as posing significant legal, reputation, or safety and soundness risk, with a focus on accounting treatments or policies that do not employ GAAP or preferred methods; and</li><li>Direct management to provide the committee with adequate information and reports to carry out its duties and responsibilities and challenge management and auditors where appropriate.&#160;</li></ul><p> <em>A. Assessing Materiality&#160;</em></p><p>An entity's audit committee should review and clearly understand how management and the external auditor assess financial statement materiality. &#160;For public financial disclosures, FHFA's regulated entities should follow materiality guidelines established by the SEC and other U.S. standard-setters and regulators as appropriate.&#160; FHFA is informed by the SEC's statements regarding materiality and generally considers them as part of its ongoing review of regulated entities' accounting practices and controls.&#160;</p><p>A regulated entity's determination that an accounting matter is material or presents a materiality issue may be a factor in FHFA's oversight of a regulated entity. &#160;An item not being deemed to be “material&quot; or not having “materiality&quot; for financial reporting purposes, however, would not necessarily preclude FHFA from having supervisory concerns about the item. &#160;Further, FHLBanks may be required to provide information that is less than material to their individual financial statements to the OF in order to support FHLBank System combined financial filings.&#160;</p><p> <em>B. Accounting Policies and Procedures&#160;</em></p><p>FHFA expects each regulated entity's management, with appropriate audit committee oversight, to establish and maintain&#58;&#160;</p><ul><li>A formal written procedure for developing accounting policies;</li><li>A process for disclosing those policies and the regulated entity's compliance with applicable regulatory requirements and GAAP to the committee;</li><li>Accounting and disclosure policies and procedures that reflect applicable regulatory requirements and GAAP; and</li><li>A complete and current accounting guide that lists all of the regulated entity's accounting policies, including a procedure for documenting the business purpose of all significant types of transactions.&#160;</li></ul><p>Each regulated entity currently submits its accounting guide to FHFA annually, and significant revisions to FHFA quarterly, although the FHFA Chief Accountant may request more frequent submissions.&#160;&#160;&#160;</p><p> <em>C. Internal Control over Financial Reporting</em></p><p>Each regulated entity is responsible for designing, implementing, monitoring, and maintaining its ICFR. <a href="#footnote7"> <span style="text-decoration&#58;underline;">[7]</span></a> &#160;&#160;Each regulated entity should ensure that its ICFR system is designed to minimize the risk of a material financial misstatement, whether due to reporting error, fraud, or other external or company-specific risks.&#160;</p><p>FHFA expects regulated entities to develop, implement, and maintain robust business and accounting systems and processes subject to rigorous quality controls to minimize the possibility of material misstatements.&#160; Regulated entities should remediate identified deficiencies timely and should not allow significant control deficiencies to persist.&#160;&#160;</p><p>ICFR review functions <a href="#footnote8"> <span style="text-decoration&#58;underline;">[8]</span></a> should be structured to ensure that those persons performing and evaluating testing are appropriately independent of the controls being tested. &#160;Each regulated entity should ensure that it has protocols in place for its employees and vendors to comply with the regulated entity's ICFR-related policies and procedures.&#160;</p><p>Each regulated entity should have a system in place to provide reasonable assurance that accounting and disclosure policies and procedures reflect regulatory and GAAP requirements and should have proper procedures and processes in place to evaluate compliance with those requirements.&#160; The ICFR risk assessment process should include assessing new products and business lines, as well as significant growth, shrinkage, and other changes in existing products and business lines. &#160;This should help ensure that key controls are identified and tested so that potential control deficiencies are identified timely and properly addressed.&#160;</p><p>Each regulated entity's management should ensure, and its audit committee should oversee, that the regulated entity establishes, implements, and maintains effective controls over information reported to FHFA through FHFA's Call Report System and in formal data requests.&#160;</p><p> <em>D. Regulated Entity Accounting Staff</em></p><p>Each regulated entity's management should hire sufficient numbers of technically competent accounting staff and that staff should remain professionally competent and current in professional standards. &#160;Accounting departments should implement and maintain quality control procedures to ensure that they follow accounting policies and procedures.&#160; Further, accounting staff should be charged with reporting any non-compliance with GAAP to appropriate management and/or auditors.&#160;</p><p> <em>E. Financial Statements</em></p><p>As SEC registrants, each FHLBank and Enterprise must prepare and timely file with the SEC periodic financial statements and disclosures that comply with applicable SEC regulations. &#160;Each regulated entity also should prepare and timely file financial statements and information as required by FHFA regulations.&#160; FHFA encourages the regulated entities to maximize transparency in their public financial reporting and disclosures, and to establish and implement policies that lead to comparable and consistent accounting and disclosures to the extent practicable. <a href="#footnote9"> <span style="text-decoration&#58;underline;">[9]</span></a></p><p>FHFA expects each FHLBank and Enterprise to submit to FHFA any financial information, disclosures, or other items it submits to the SEC that are not available to FHFA in public filings. &#160;FHFA also expects each regulated entity to provide additional information about the financial information, disclosures, and other items it submits to the SEC when and in the manner requested by FHFA.</p><p> <em>F. Non-GAAP Measures in Financial Statements</em></p><p>Regulated entities should consider risks associated with presenting non-GAAP measures in public financial reports, along with their responsibilities to transparently inform stakeholders about the entity's financial condition and results of operations.&#160; If a regulated entity decides to disclose a non-GAAP measure in its periodic filings, that measure should be subject to rigorous internal controls, should not be presented more prominently than similar GAAP measures, and should otherwise conform to applicable regulations.&#160; Any new proposed non-GAAP measure should be discussed with the audit committee, as appropriate, prior to initial publication.&#160; </p><p> <em>G. Alternate and Preferable GAAP Accounting Treatments</em></p><p>At least quarterly, each regulated entity's audit committee should review management's analyses of significant financial reporting issues and accounting judgments made in preparing the entity's financial statements.&#160; To facilitate this review, management should highlight, and the committee should review, significant new or unusual items arising during the financial quarter, and management's anticipated implementation of significant new or revised GAAP.&#160; These reviews should include effects of alternative GAAP methods.&#160; The audit committee should also review and discuss these areas (and others as described in applicable rules, regulations, and guidance) with the external auditor.&#160;</p><p>FHFA believes that it is prudent for the regulated entities' audit committees to assess the costs and benefits of engaging an independent third party to evaluate one or more accounting policy areas at least every two years.&#160; Committees should report their findings to their board of directors and to FHFA.&#160; Such a review may be appropriate for new or revised GAAP guidance and/or for new types of transactions that the regulated entity expects to become material, especially those for which the accounting may involve significant estimates and/or management judgments.&#160;&#160;&#160;</p><p>If the audit committee determines that the results of any such assessment warrant a targeted evaluation, it should then consider the appropriate form and scope of the engagement.&#160; Given the potential relevance of such assessments to FHFA's supervisory responsibilities, the regulated entity should structure any targeted evaluation engagement so as to make reports and workpapers available for review by FHFA.&#160;</p><p> <strong>II. External Audit Function Oversight</strong></p><p>Rigorous and effective audit committee oversight of external audit functions is critical to secure the benefits of an independent, high-quality audit.&#160; FHFA expects each regulated entity's audit committee to perform this role in accordance with applicable FHFA, SEC, and NYSE requirements.&#160; Further, FHFA expects each audit committee to establish and maintain appropriate charter elements, and well-documented policies where needed, around this oversight role. &#160;Finally, FHFA encourages regulated entities to develop, and audit committees to regularly review and approve for publication, disclosures that provide insight and information to stakeholders about how the committees oversee their external auditors.</p><p>A. Overseeing the External Audit Relationship</p><p>The concepts in this section should be considered when appointing, retaining, or terminating an external auditor.</p><p>1. Monitoring Performance</p><p>Each regulated entity's audit committee should perform and document a comprehensive assessment of the external audit firm's performance at least annually.&#160; As part of the review, the committee should request and review input from audit committee members, management, and internal auditors regarding the performance of the external auditors.&#160; The current external auditor's tenure should be considered as a factor in the assessment.&#160;</p><p>FHFA expects each audit committee to identify and consider Audit Quality Indicators (AQIs) to inform dialogue and discussions with the external auditor. &#160;AQIs are qualitative and quantitative performance metrics to help inform stakeholders, including audit committees, about key conditions or attributes that may contribute to audit quality. &#160;AQIs may be defined at both the auditing firm and the audit engagement team levels.&#160; While there is no regulation or auditing standard requiring firms to report or audit committees to use AQIs, larger auditing firms provide firm-level AQIs and/or similar information to their stakeholders. <a href="#footnote10"> <span style="text-decoration&#58;underline;">[10]</span></a> &#160;FHFA views identifying and assessing AQIs as a best practice in assessing external auditor performance.&#160;</p><p>The audit committee should consider the external auditor's internal quality control procedures, including the auditing firm's processes for performing quality control reviews, when evaluating the external auditor.&#160; The committee should discuss the auditing firm's internal quality control reviews and external PCAOB inspection results with the external auditors as part of their performance assessment. &#160;The committee should pay particular attention to any deficiencies or non-compliance issues identified by the PCAOB or internal reviews that are relevant to their regulated entity's audit.&#160; To aid in this process, the audit committee should request that the external auditor align any PCAOB inspection deficiencies with potential areas of exposure to the audit of the regulated entity.&#160; The audit committee should have a good understanding of how the audit firm is addressing any identified deficiencies, including remediation plans and timetables.</p><p>Auditing firm tenure is not explicitly addressed by FHFA or SEC regulations. &#160;Even if an incumbent auditing firm has performed satisfactorily, FHFA considers it prudent for audit committees to periodically consider, and document their consideration of, the potential costs and benefits of changing or retaining their incumbent auditing firms at least every five years, or more frequently if circumstances warrant. <a href="#footnote11"> <span style="text-decoration&#58;underline;">[11]</span></a> &#160;</p><p>2. Monitoring Independence</p><p>External auditor independence is necessary for a reliable audit. &#160;Therefore, each regulated entity's audit committee should carefully consider regulatory and professional requirements regarding independence in fact and appearance during all phases of the audit engagement. <a href="#footnote12"> <span style="text-decoration&#58;underline;">[12]</span></a>&#160; Independence requirements apply to the external auditing firm, to engagement and concurring partners, and to auditing firm staff and contractors working on the engagement. The audit committee should have a robust process for monitoring and assessing the external auditor's independence, including understanding how the external auditor assesses and monitors independence within the auditing firm.&#160;</p><p>The external auditor's communications to the audit committee regarding independence and the committee's related discussions and decisions regarding the auditor's independence should be appropriately documented.&#160; Arrangements regarding any permissible non-audit services to be provided by the audit firm should be clear and transparent, should not involve contingent compensation other than appropriate arrangements for tax work, and should be pre-approved by the audit committee.&#160; If the committee delegates some of its pre-approval authority to, for example, its Chair, it should subsequently ratify the delegate's approval.&#160;&#160;</p><p>At least annually, the committee should review the nature of all services performed by the external audit firm and assess the relative magnitude of fees and personnel involved.&#160; The committee should then consider establishing safeguards, as needed, to mitigate potential threats to audit independence that may arise as a result of providing these other services.&#160; Further, the audit committee should be informed about and consider business and financial relationships between the auditor and the regulated entity or its officers, directors, or significant shareholders, and about employment of former regulated entity employees by the auditing firm and vice versa, as necessary to identify and address circumstances that could indicate a lack of independence or the appearance thereof.&#160;</p><p> <em>B. Communication with External Auditor and Audit Engagement Letters</em></p><p>Each regulated entity's audit committee and its external auditor should have an open working relationship.&#160; Communications should be frank and robust and should cover the full range of potential topics related to financial reporting and audit risks.&#160; Significant discussions during scheduled audit committee meetings should be clearly documented in committee minutes.&#160; Other relevant substantive discussions should be appropriately documented in audit committee packages or minutes.&#160; Audit committees can promote effective communications by&#58;&#160;</p><ul><li>Maintaining a direct line of communication with the external auditor, including periodic, informal contact by the committee chair and regular executive sessions;</li><li>Requesting periodic involvement of other external audit partners, such as concurring, review, and tax partners at the audit committee meetings; </li><li>Discussing the external auditor's audit risk assessment and audit plan for the regulated entity;</li><li>Discussing with the auditor (and management, as applicable) any new, unusual, or non-standard representations made by management in their management representations letter; and</li><li>Requesting and reviewing insights from audit committee members, management, and internal auditors regarding the performance of the external auditors, at least annually.&#160;</li></ul><p>It is also important for the audit committee to have ongoing communication with the external auditor regarding its audit fees.&#160; One objective of those communications is to provide assurance to the audit committee that negotiations for the fees and the fee arrangements themselves encourage the external auditor to conduct rigorous, high-quality audits and reviews.&#160;</p><p>The engagement letter is the key document defining the relationship between the regulated entity and its external auditor.&#160; FHFA's authority to examine the regulated entities allows it to have access to all regulated entity documents, including accounting records. &#160;FHFA expects regulated entities' external audit engagement letters to be consistent with FHFA's examination authority. &#160;Accordingly, FHFA expects that each regulated entity's engagement letter should&#58;&#160;</p><ul><li>Provide that the external auditor may, upon FHFA's request, provide FHFA with access to the senior audit partners on the engagement and any other personnel whom such partners deem necessary, as well as to the external auditor's working papers prepared in the course of performing the services set forth in the engagement letter, and that such access to the external auditor may be without regulated entity personnel in attendance;</li><li>Not contain any provisions that would be characterized as unsafe and unsound under the “Interagency Advisory on the Unsafe and Unsound Use of Limitation of Liability Provisions in External Audit Engagement Letters&quot;;<a href="#footnote13"><span style="text-decoration&#58;underline;">[13]</span></a> and</li><li>Provide that the external auditor, without the approval of the regulated entity, may meet with FHFA with such frequency and about such matters as determined by FHFA, and may provide reports or other communications arising from the audit engagement directly to FHFA.</li></ul><p> <em>C. Audit Committee Transparency</em></p><p>FHFA regulations and guidelines require that the audit committees for the regulated entities review their charters annually and that the boards of directors reapprove them at least every three years. <a href="#footnote14"> <span style="text-decoration&#58;underline;">[14]</span></a> &#160;&#160;FHFA's regulated entities regularly publish their audit committee charters.&#160; Besides serving as the committee's roadmap to help ensure that it fulfills all of its duties and obligations, a well-drafted charter can provide outside readers with insights on the committee's governance and functions.&#160;</p><p>Under the PCAOB standards, auditor tenure is now a required element of the independent auditor's report.&#160; Also, critical audit matters—which are matters that have been communicated to the audit committee, are related to accounts or disclosures that are material to the financial statements, and involved especially challenging, subjective, or complex auditor judgment—must be reported by the auditor beginning in the next few years. <a href="#footnote15"> <span style="text-decoration&#58;underline;">[15]</span></a>&#160; While this reporting is the responsibility of public companies' external auditors, we believe that these requirements evidence increased demand by financial statement users for information on audits and audit governance.&#160;&#160;</p><p>While effective audit committee oversight of and engagement with the external auditor are keys to obtaining a high-quality audit, there are no formal rules or standards that require those topics to be reported to shareholders. &#160;That said, industry studies confirm an increasing trend among public companies to make enhanced voluntary disclosures about their audit committees' oversight of the external audit function. &#160;Examples include disclosures about the factors that the audit committee considers when appointing or retaining an external auditor, the role of the audit committee in fee negotiations and compensation, the length of time the auditor has been engaged, whether evaluations of the auditing firm are done annually, and audit partner selection and rotation. <a href="#footnote16"> <span style="text-decoration&#58;underline;">[16]</span></a>&#160;</p><p>FHFA encourages each regulated entity's audit committee to consider providing such voluntary disclosures regarding its role in supporting a quality audit. &#160;The audit committee should remain aware of industry trends and developments regarding audit committee transparency and should work to provide the regulated entity's stakeholders with relevant information regarding their activities to the extent practicable.&#160;</p><p> <strong>III. Annual Review by Audit Committee</strong></p><p>At least annually, each regulated entity's audit committee should review, with any appropriate professional assistance, the committee's performance in light of the requirements of laws, rules, and regulations that are applicable to its activities and duties.&#160; The committee should also assess whether it is operating consistent with applicable regulatory guidance.&#160; The audit committee should provide the FHFA Chief Accountant with the materials and procedures employed in such review, as well as the final report. &#160;The review may be done as part of a committee self-assessment, an outside review, or a combination of approaches.&#160;</p><p> <strong>Related Regulations and Guidance</strong></p><p>12 CFR Part 1236 and Appendix – Prudential Management and Operations Standards&#160;</p><p>12 CFR Part 1239 – Responsibilities of Boards of Directors, Corporate Practices and Corporate Governance Matters&#160;</p><p>12 CFR Part 1273 – Office of Finance&#160;</p><p>12 CFR Part 1274 – Financial Statements of the Banks&#160;</p><p>Securities and Exchange Commission Guidance Regarding Management's Report on Internal Control Over Financial Reporting Under Section 13(a) or 15(d) of the Securities Exchange Act of 1934, 72 Fed. Reg. 35324 (June 27, 2007) (codified at 17 CFR Part 241)</p><p>Securities and Exchange Commission Rule 10A-3&#58; Listing Standards Relating to Audit Committees (National Securities Exchanges), 17 CFR § 240.10A-3</p><p>Securities and Exchange Commission Rule Reg. S-X&#58; Form and Content of and Requirements for Financial Statements, Securities Act of 1933, Securities Exchange Act of 1934, Investment Company Act of 1940, Investment Advisers Act of 1940, and Energy Policy and Conservation Act of 1975 (Qualifications and Reports of Accountants), 17 CFR § 210.2-01 through -07</p><p>Securities and Exchange Commission Rule Reg. S-K&#58; Standard Instructions for Filing Forms under Securities Act of 1933, Securities Exchange Act of 1934 and Energy Policy and Conservation Act of 1975, 17 CFR Part 229</p><p>Public Company Accounting Oversight Board Rule 3526&#58; Auditor Communications with Audit Committees Concerning Independence</p><p>NYSE, Inc., Listed Company Manual, § 303A (Corporate Governance Standards) (2018)</p><p> <br>&#160;</p><hr width="25%" align="left" /><p> <a name="footnote1"><span style="text-decoration&#58;underline;">[1]</span></a>&#160;The OF is not a “regulated entity&quot; as the term is defined by 12 U.S.C. 4502(20), but for convenience, references to the “regulated entities&quot; in this AB should be read to also apply to the OF as regards its roles in issuing combined financial reports and engaging the external auditor for those reports, and to regulated entities' affiliates as regards their roles, if any, in issuing public financial reports and in engaging external auditors.</p><p> <a name="footnote2"><span style="text-decoration&#58;underline;">[2]</span></a>&#160;Duties of FHLBank audit committees are described in 12 CFR 1239.32. Duties of the OF audit committee are described in 12 CFR 1273.9. Part 1239 stipulates that the duties and responsibilities of Enterprise audit committees are set forth under rules issued by the New York Stock Exchange, and further requires that those committees comply with requirements set forth under section 301 of the Sarbanes-Oxley Act, 15 U.S.C.§ 78j-1(f). The Prudential Management and Operations Standards set forth in the Appendix to 12 CFR Part 1236 also include standards applicable to the audit committees of the FHLBanks and Enterprises.</p><p> <a name="footnote3"> <span style="text-decoration&#58;underline;">[3]</span></a><em>&#160;See </em>12 CFR 1274.2(c).</p><p> <a name="footnote4"> <span style="text-decoration&#58;underline;">[4]</span></a><em>&#160;See </em>12 CFR 1274.2(c).</p><p> <a name="footnote5"> <span style="text-decoration&#58;underline;">[5]</span></a><em>&#160;See </em>12 CFR 1274.2(d), (e).</p><p> <a name="footnote6"> <span style="text-decoration&#58;underline;">[6]</span></a><em>&#160;See </em>12 CFR Part 1236, Appendix (Standard 10.1) and 12 CFR 1273.6(b) (2).</p><p> <a name="footnote7"> <span style="text-decoration&#58;underline;">[7]</span></a> SEC Exchange Act Rule 13a-15(f) defines the term “internal control over financial reporting&quot; as&#58; a process designed by, or under the supervision of, the issuer's principal executive and principal financial officers, or persons performing similar functions, and effected by the issuer's board of directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles and includes those policies and procedures that&#58;</p><ol><li>Pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the issuer;</li><li>Provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the issuer are being made only in accordance with authorizations of management and directors of the issuer; and</li><li>Provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the issuer's assets that could have a material effect on the financial statements.</li></ol><p> <em>See </em>17 CFR 240.13a-15(f).</p><p> <a name="footnote8"> <span style="text-decoration&#58;underline;">[8]</span></a> For the OF, this refers to the ICFR over the OF's process for producing the FHLBanks' combined financial reports.&#160;</p><p> <a name="footnote9"> <span style="text-decoration&#58;underline;">[9]</span></a> On comparability and consistency, see FASB Statement of Financial Accounting Concepts No. 8 as amended August 2018.</p><p> <a name="footnote10"> <span style="text-decoration&#58;underline;">[10]</span></a> See Center for Audit Quality, “Audit Quality Indicators&#58;&#160; The Journey and Path Ahead,&quot; Jan. 12, 2016.</p><p> <a name="footnote11"> <span style="text-decoration&#58;underline;">[11]</span></a> The FHLBanks and the OF, in light of the FHLBank System's requirement to issue combined financial statements, have historically engaged the same external audit firm.&#160; Therefore, they undertake external auditor performance reviews and decisions on which audit firm to engage jointly.</p><p> <a name="footnote12"> <span style="text-decoration&#58;underline;">[12]</span></a> The external auditor must meet the requirements of independence set forth by the PCAOB Auditing Standard 1005 and in the SEC regulations at 17 CFR § 210.2-01.&#160;</p><p> <a name="footnote13"> <span style="text-decoration&#58;underline;">[13]</span></a> 71 Fed. Reg. 6847 (Feb. 9, 2006).</p><p> <a name="footnote14"> <span style="text-decoration&#58;underline;">[14]</span></a><em>&#160;See </em>12 CFR Part 1236, Appendix (Prudential Management and Operations Standard 2.2) (regulated entity boards); 12 CFR 1239.32(d) (1), (2) (Bank audit committees and boards of directors); 12 CFR 1273.9(c) (1) (i), (ii) (Office of Finance). Enterprise boards of directors must adopt a written charter for each board committee and comply with the committee requirements of the NYSE rules and section 301 of the Sarbanes-Oxley Act, 15 U.S.C. § 78j-1. <em>See </em>12 CFR 1239.5(b). Neither those incorporated provisions nor the regulation itself imposes any requirements with respect to the review or re-approval of committee charters.</p><p> <a name="footnote15"> <span style="text-decoration&#58;underline;">[15]</span></a><em>&#160;See </em>PCAOB Auditing Standard 3101.</p><p> <a name="footnote16"> <span style="text-decoration&#58;underline;">[16]</span></a><em>&#160;See </em>2018 Audit Committee Transparency Barometer prepared by the Center for Audit Quality and by Audit Analytics (November 2018).</p><p> <em>&#160; </em></p> <em> <table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width&#58;100%;"><p>FHFA has statutory responsibility to ensure the safe and sound operations of the regulated entities and the Office of Finance. Advisory bulletins describe FHFA supervisory expectations for safe and sound operations in particular areas and are used in FHFA examinations of the regulated entities. Questions about this advisory bulletin should be directed to <a href="mailto&#58;SupervisionPolicy@FHFA.gov">SupervisionPolicy@FHFA.gov</a>. </p></td></tr></tbody></table> <p>&#160;</p></em>8/20/2020 5:00:54 PMHome / Supervision & Regulation / Advisory Bulletins / Financial Reporting and Disclosure and External Audit Advisory Bulletin AB 2020-04: FINANCIAL REPORTING AND DISCLOSURE 1472https://www.fhfa.gov/SupervisionRegulation/AdvisoryBulletins/Pages/Forms/AllItems.aspxhtmlFalseaspx
Credit Risk Transfer – Analysis and Reporting27606Fannie Mae & Freddie Mac11/14/2019 5:00:00 AMAB 2019-06<table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width&#58;100%;"><p>ADVISORY BULLETIN</p><p>AB 2019-06&#58; Credit Risk Transfer – Analysis and Reporting</p></td></tr></tbody></table><p> <strong style="text-decoration&#58;underline;"> <em> <br>Purpose</em></strong></p><p>This advisory bulletin articulates the Federal Housing Finance Agency’s (FHFA) supervisory expectations for the analysis and internal reporting of certain proposed or in-force credit risk transfer (CRT) activities.&#160; This advisory bulletin applies to Fannie Mae and Freddie Mac (Enterprises) and is effective immediately.</p><p>The scope of this advisory bulletin addresses risk analysis and reporting for individual and aggregate CRT activities.&#160; This advisory bulletin excludes primary mortgage insurance, seller indemnification, collateralized lender recourse, and multifamily lender loss sharing.</p><p>Enterprise CRT activities include debt instruments with varying structures and characteristics as well as insurance or reinsurance transactions and senior/subordinate securitizations.&#160; CRT programs are integrated with core single-family and multifamily business activities and affect the Enterprises’ overall credit risk profiles.&#160; </p><p>The comprehensive analysis and internal reporting of CRT activities support Enterprise safety and soundness.&#160; The Enterprises’ CRT programs could pose considerable financial risk exposure if associated risks are not adequately understood and managed.&#160; Robust risk analysis coupled with effective reporting to senior management and, as appropriate, the board of directors could identify potential risk and further support the oversight of the CRT program.&#160; </p><p>The guidance section outlines FHFA’s supervisory expectations regarding analysis and reporting for CRTs.&#160; The Enterprises may augment the analyses included in this advisory bulletin with other types of analyses deemed appropriate by management or the board of directors.<br></p><p> <strong style="text-decoration&#58;underline;"><em>Background</em></strong></p><p>The ownership or guarantee of mortgage-related instruments exposes the Enterprises to credit risk.&#160; Credit risk transfers can moderate the risk of credit-related losses and expenses by mitigating the Enterprises’ credit risk exposure.&#160; The Enterprises routinely transfer credit risk to third-party investors through the capital markets, and to insurance and reinsurance companies through negotiated transactions.</p><p>The use of CRT transactions alters the earnings and credit risk profiles of the Enterprises by transferring some portion of estimated credit losses.&#160; Modeling applications estimate these credit losses.&#160; Credit losses transferred to investors or insurers, over the term of the CRT transaction, could differ significantly from the Enterprises’ original estimates of expected credit losses absorbed by investors or insurers.&#160; </p><p>This advisory bulletin discusses approaches designed to provide both an economic view as well as a view into the financial impact of CRT transactions.&#160; <br>Risks associated with CRT transactions, as noted in more details below, include residual credit risk, financial risk, price risk, model risk, counterparty credit risk, and mark-to-market risk.&#160; Fully understanding the risks and their potential earnings and capital impact is an important step in determining appropriate risk mitigants for those risks that can be controlled and reasonably managed. </p><p> <em>Residual Credit Risk</em></p><p>Residual credit risk refers to the credit risk remaining with the Enterprises from the loans in the reference pool.&#160; Typically, only a portion of credit risk is transferred at the origination of the CRT transaction.&#160; Additionally, termination dates for some CRT transactions may be earlier than the contractual maturity of the underlying single-family or multifamily mortgage loans in the reference pool.&#160; If credit loss events on single-family or multifamily loans in the reference pool occur after the maturity of the CRT issuance or insurance transaction, the Enterprises remain exposed to residual credit risk for the lifetime of loans remaining in the original reference pool.</p><p> <em>Financial Risk</em></p><p>Financial risk is the uncertain net earnings and balance sheet impact attributed to the costs and the credit loss protection provided by investors or insurers.&#160; The Enterprises’ cost to purchase credit protection through CRT transactions may be substantial in relation to guarantee fee revenue.&#160; The expected credit risk mitigation provided by investors and insurers is not precisely known at origination and requires complex calculations to estimate.&#160; Financial risk could be significant and could negatively affect corporate profitability and capital levels.</p><p> <em>Price Risk</em></p><p>Price risk refers to the risk that it may not be feasible for an Enterprise to enter into new CRT transactions because of market-driven costs.&#160; An Enterprise’s ability to transfer credit risk on an ongoing and regular basis is dependent on third-party investor or counterparty demand to enter into new transactions, but this demand may significantly weaken or disappear during periods of adverse economic or poor market conditions.&#160; The interest of market participants may vary over housing price cycles and could influence demand for new and existing CRT instruments.&#160; The countercyclical nature of some CRT transactions could expose the Enterprises to price risk, as they may incur considerably higher costs by entering into CRT transactions during times of significant economic downturns or severely adverse market disruptions.</p><p> <em>Model Risk</em></p><p>Model risk refers to the earnings and capital exposure from inadequate model results or weaknesses in model governance, processes, or controls.&#160; Enterprise management relies in part on sophisticated quantitative analyses and complex models.&#160; These models estimate Enterprise credit risk, including the financial costs of CRT transactions.&#160; Estimates of mortgage interest rates and house price movements are significant factors in management’s analysis.&#160; Models and analytical processes are sensitive to data inputs, key assumptions, and the complexity of calculation methodologies.&#160; </p><p> <em>Counterparty Credit Risk</em></p><p>Some CRT transactions introduce counterparty credit risk.&#160; While CRT transactions serve to reduce credit risk exposure from individual borrowers, the reduction may be partially offset by added credit risk from corporate counterparties.&#160; Counterparty credit risk is introduced in insurance-related CRT transactions, as the risk that an insurance company will not fulfill its potential obligation is substituted for the risk that individual borrowers will not meet their obligation with respect to the underlying mortgage loan.</p><p> <em>Mark-to-Market Risk</em></p><p>Mark-to-market risk refers to the market price volatility or sensitivity associated with CRT issuances.&#160; The Enterprises are exposed to mark-to-market risk for some CRT transactions.&#160; Changes in fair market values may have a negative financial performance or capital impact.&#160; For example, an Enterprise may issue unsecured debt in the form of a CRT transaction and record fair market gains or losses based on price changes.&#160; Hedging activities may mitigate the underlying mark-to-market risk inherent in the CRT transaction.<br></p><p> <strong style="text-decoration&#58;underline;"><em>Guidance</em></strong></p><p>This section outlines FHFA’s supervisory expectations regarding analysis and internal reporting for CRTs.&#160; The analyses described below will allow senior management to understand individual and aggregate CRT transactions and inform corporate business decisions, and the aggregate reporting will inform the board of directors or a designated committee of the board.&#160; These analyses should be completed in a timely manner, and documentation should include an explanation and support for significant management assumptions or estimates, detailed model results, and key analytical factors.&#160;&#160;</p><p style="margin-left&#58;40px;"> <strong>I. Analysis of CRT</strong></p><p>Analyses A, B, and D described below do not depend on economic, regulatory, or imputed capital or capital costs.</p><p style="margin-left&#58;40px;"> <em>A.&#160;Analysis of Expected Revenues and Expected Costs</em></p><p style="margin-left&#58;80px;">1. Transaction-Level Analysis</p><p style="margin-left&#58;80px;">Transaction-level analyses should thoroughly evaluate the financial value of individual CRT transactions, that is, the expected revenues and expected costs that result from CRT transactions.&#160; Revenues and costs include guarantee-fee income, expected default costs, and transaction costs associated with a CRT structure. The cashflow analysis should cover the full term of the underlying mortgages in the reference pool.&#160; Management should use stochastic credit risk models to generate forecasts of prepayment, default, and severity using relevant macroeconomic factors.&#160; The macroeconomic factors, at a minimum, include interest rates and house prices.&#160; For a meaningful analysis, a wide-range of economic scenarios should be included.</p><p style="margin-left&#58;80px;">Two types of transaction-level analyses should be performed on the reference pool&#58;&#160; (a) transaction analysis without CRT; and (b) transaction analysis with CRT.&#160; Both types of transaction-level analysis should use the methods described above.&#160; </p><p style="margin-left&#58;80px;"> <em>(a) Transaction Analysis without CRT.</em>&#160; This analysis evaluates the estimated cashflows by calculating estimated expected pre-tax revenues (guarantee fees) and associated expected expenses (including credit losses and interest expense) for the reference pool.&#160; Management should calculate the revenues and expenses for each of the simulated paths.&#160; The path-level results should then be aggregated to determine overall expected net revenue.</p><p style="margin-left&#58;80px;"> <em>(b) Transaction Analysis with CRT.</em>&#160; This analysis evaluates the estimated cashflows by calculating estimated expected pre-tax revenues (guarantee fees) and associated expected expenses (including credit losses and interest expense) for the reference pool.&#160; Management should calculate the revenues and expenses for each of the simulated paths with the proposed CRT transaction.&#160; The path-level results should then be aggregated to determine overall expected net revenue.</p><p style="margin-left&#58;80px;">In addition to analyses (a) and (b), management should develop at least one stress test by evaluating revenue and credit losses absorbed by investors or insurers for paths that exceed a specific high confidence level (e.g., 90%, 95%, or 99%).&#160;&#160; For CRT transactions with a counterparty credit risk component, transaction analyses should incorporate an assessment of the credit risk associated with the underlying counterparty.</p><p style="margin-left&#58;80px;">2. Consolidated Analysis </p><p style="margin-left&#58;80px;">Consolidated analysis should assess the net financial impact of aggregated CRT transactions on financial performance.&#160; This analysis should calculate the impact of existing CRT transactions incorporating all business segments of corporate revenue and expenses.&#160; The results should provide insight into the aggregate and full impact of CRTs.</p><p style="margin-left&#58;80px;">In order to conduct the consolidated analysis, the stochastic analysis to estimate net revenues and credit losses absorbed by investors or insurers described above should be estimated (ex-post, on a transaction level) and aggregated. </p><p style="margin-left&#58;40px;"> <em>B.&#160;Earnings Forecast Analysis</em></p><p style="margin-left&#58;80px;">Earnings forecast analysis should assess the annual forecasted generally accepted accounting principles (GAAP) impact for aggregate CRT activities.&#160; This analysis should be designed to calculate the impact of existing CRT transactions on future corporate revenue and expenses.&#160; The analysis should cover each year of the duration of all CRT transactions existing at the time of the analysis.</p><p style="margin-left&#58;80px;">The methodology used for this earnings forecast analysis should be comparable to the transaction-level financial analysis (described above) to allow for meaningful benchmarking analysis.&#160; Specifically, individual transactions should be modeled stochastically before results are consolidated.&#160; Key model methodology, assumptions, and inputs should be transparent and well supported.&#160; Stress testing should also be a component of the earnings forecast analysis to add a meaningful dimension.&#160; The earnings forecast analysis should include sufficient time period intervals to allow Enterprise management to assess significant timing differences between CRT expenses or costs and the absorption of credit losses by investors or insurers that may occur well after the initial CRT transaction.</p><p style="margin-left&#58;40px;"> <em>C.&#160;Price Risk Analysis </em></p><p style="margin-left&#58;80px;">The price risk analysis should measure the strength and health of the CRT market in order to assess the economic sensibility of entering into new CRT transactions.&#160; The cost to transfer credit risk may vary depending on the position of the economy in the economic cycle.&#160; It may be more expensive for the Enterprises to transfer credit risk during periods of economic instability or uncertainty.&#160; Enterprise management should develop measures to analyze CRT price risk.&#160; </p><p style="margin-left&#58;80px;">Enterprise secondary market purchases or sales of previously issued CRT securities should include consideration of the potential impact on corporate CRT strategies and overall CRT effectiveness.&#160; These transactions could reduce the amount of credit risk that has previously been transferred through a CRT transaction.&#160; For this reason, an analysis of the potential impact to CRT effectiveness should be performed prior to secondary market transactions.</p><p style="margin-left&#58;40px;"> <em>D.&#160;Industry Analyses </em></p><p style="margin-left&#58;80px;">Credit rating agencies and other industry participants play a role in the Enterprise CRT market.&#160; Industry participants may conduct analytical assessments for individual CRT instruments using proprietary models and evaluation techniques.&#160; Management should review and understand the analytical approach and results of analyses performed by rating agencies or other industry participants and identify significant differences from internal Enterprise analyses.</p><p style="margin-left&#58;40px;"> <strong>II.&#160;Management and Board of Directors Reporting</strong><br></p><p style="margin-left&#58;40px;">The management and board of directors reporting described in this section may be presented as independent, standalone reports, or incorporated into existing reporting processes.&#160; If incorporated into existing reporting processes, management should ensure that CRT analysis results are given attention commensurate with the significance of the analytical results and findings.&#160; Whether standalone or incorporated into an existing reporting process, the CRT reports should contain sufficient detail to adequately inform the intended audience and sufficiently support related business decisions.</p><p style="margin-left&#58;40px;"> <em>A.&#160;Analysis of Expected Revenues and Expected Costs</em></p><p style="margin-left&#58;80px;">1. Transaction-Level Analysis</p><p style="margin-left&#58;80px;">The results of the transaction-level analyses for individual single-family CRT transactions should be included in transaction-level, pre-transaction analysis reported to business line management.&#160; For multifamily CRT transactions, results may be aggregated and reported to business line management on a quarterly basis.&#160; Senior management should also review a summary of transaction reports.</p><p style="margin-left&#58;80px;">2. Consolidated Analysis</p><p style="margin-left&#58;80px;">The CRT consolidated analysis should be prepared on at least an annual basis with detailed results reported to senior management.&#160; The board of directors or designated board committee should review a summary of the consolidated analysis.</p><p style="margin-left&#58;40px;"> <em>B.&#160;Earnings Forecast Analysis </em></p><p style="margin-left&#58;40px;">The CRT earnings forecast analysis should be prepared on at least an annual basis with detailed results reported to senior management.&#160; The board of directors or designated board committee should review a summary of the earnings forecast analysis.</p><p style="margin-left&#58;40px;"> <em>C.&#160;Price Risk Analysis </em></p><p style="margin-left&#58;40px;">Price risk analysis results should be incorporated into senior management reporting.</p><p style="margin-left&#58;40px;"> <em>D.&#160;Industry Analyses </em></p><p style="margin-left&#58;40px;">Internal evaluations of industry CRT analyses should be reported to business line management at least annually, with more frequent reporting or reporting to Enterprise management and, the board of directors, or designated board committee, as appropriate, if interim analyses indicate significant findings.</p><p> <br> <em><strong style="text-decoration&#58;underline;">Related Guidance and Regulations</strong></em></p><p>12 CFR Part 1236, Appendix, Prudential Management and Operations Standards. </p><p>12 CFR Part 1239, Responsibilities of Boards of Directors, Corporate Practices, and Corporate Governance.</p><p> <em> <a href="/SupervisionRegulation/AdvisoryBulletins/Pages/Interest-Rate-Risk-Management_2018-09.aspx">Interest Rate Risk Management</a></em>, Federal Housing Finance Agency, Advisory Bulletin AB-2018-09, September 28, 2018.</p><p> <em> <a href="/SupervisionRegulation/AdvisoryBulletins/AdvisoryBulletinDocuments/AB_2013-07_Model_Risk_Management_Guidance.pdf">Model Risk Management Guidance</a></em>, Federal Housing Finance Agency, Advisory Bulletin AB-2013-07, November 20, 2013.<br></p>&#160;&#160;&#160;&#160;&#160;&#160; <table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width&#58;100%;"><p>FHFA has statutory responsibility to ensure the safe and sound operations of the regulated entities and the Office of Finance. &#160;Advisory bulletins describe FHFA supervisory expectations for safe and sound operations in particular areas and are used in FHFA examinations of the regulated entities and the Office of Finance. &#160;Questions about this advisory bulletin should be directed to&#58;&#160; <a href="mailto&#58;SupervisionPolicy@fhfa.gov">SupervisionPolicy@fhfa.gov</a>. </p></td></tr></tbody></table>11/14/2019 8:01:21 PMHome / Supervision & Regulation / Advisory Bulletins / Credit Risk Transfer – Analysis and Reporting Advisory Bulletin AB 2019-06: Credit Risk Transfer – Analysis and 3189https://www.fhfa.gov/SupervisionRegulation/AdvisoryBulletins/Pages/Forms/AllItems.aspxhtmlFalseaspx
Compliance Risk Management27499Fannie Mae & Freddie Mac10/3/2019 4:00:00 AMAB 2019-05<table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width&#58;100%;"><p>ADVISORY BULLETIN</p><p>AB 2019-05&#58; Compliance Risk Management</p></td></tr></tbody></table><p> <strong style="text-decoration&#58;underline;"><em><br>Purpose</em></strong><br><br>This advisory bulletin (AB) communicates to Fannie Mae and Freddie Mac (the Enterprises) the Federal Housing Finance Agency’s (FHFA) supervisory expectations for a compliance risk management program (compliance program) <span class="ms-rteStyle-References"> </span> <a href="#footnote1"> <span class="ms-rteStyle-References"><span style="text-decoration&#58;underline;">[1]</span></span></a>&#160; to maintain the safety and soundness of the Enterprises’ operations.&#160; The sophistication of the compliance program should be proportionate to each Enterprise’s size, complexity, and risk profile.&#160; The compliance program should be designed to promote compliance with applicable laws, regulations, rules, prescribed practices, internal policies and procedures, and ethical and conflict-of-interest standards (compliance obligations).&#160;</p><p> <strong style="text-decoration&#58;underline;"><em>Background</em></strong></p><p>Compliance risk is the risk of legal or regulatory sanctions, damage to the current or projected financial condition, damage to business resilience, or damage to reputation resulting from nonconformance with compliance obligations.<a href="#footnote2"><span class="ms-rteStyle-References" style="text-decoration&#58;underline;">[2]</span></a>&#160; In addition, an Enterprise may be exposed to compliance, reputational, or other risks as a result of a third-party provider's failure to comply with the Enterprise's expectations and operating standards and to meet all relevant legal and contractual requirements.&#160; An effective compliance program supports safe and sound operations through policies and procedures designed to enable oversight of compliance risk management by the board of directors, or appropriate board-level committee (board). </p><p>Effective management of compliance risk requires the Enterprises to address numerous complex compliance obligations and the Enterprises' high volume of transactions.&#160; The guiding principles of sound risk management are set forth in FHFA's regulation at 12 CFR Part 1239, Responsibilities of Boards of Directors, Corporate Practices and Corporate Governance (Corporate Governance Rule), and in the Appendix to 12 CFR Part 1236, Prudential Management and Operations Standards (PMOS).&#160; </p><p>FHFA's general standards for safe and sound operations are set forth in the PMOS. &#160;Three relevant PMOS articulate guidelines for an Enterprise's board of directors and senior management to evaluate when establishing internal controls and information systems (Standard 1), overall risk management processes (Standard 8), and maintenance of adequate records (Standard 10). &#160;While the guiding principles of sound risk management in the Corporate Governance Rule and the PMOS are the same for compliance risk as for other types of risk, the management of compliance risk presents certain unique challenges.&#160; For example, compliance risk appetite and metrics may be difficult to establish and measure and compliance obligations must be addressed on an Enterprise-wide basis.<a href="#footnote3"><span style="text-decoration&#58;underline;">[3]</span></a>&#160; In addition, while compliance risks associated with third-party providers may be difficult to monitor based on information gathered in the normal course of business, the Enterprises should anticipate and manage exposures associated with third-party provider relationships across the Enterprises' full range of operations.<a href="#footnote4"><span style="text-decoration&#58;underline;">[4]</span></a></p><p> <strong style="text-decoration&#58;underline;"><em>Guidance</em></strong></p><p>FHFA expects each Enterprise to have a comprehensive, risk-based compliance program aligned with its enterprise-wide risk management program<a href="#footnote5"><span style="text-decoration&#58;underline;">[5]</span></a> and in accordance with all relevant FHFA guidance.&#160; An Enterprise's compliance program should include policies and procedures designed to manage compliance risk across its entire organization, both within and across business lines and the three lines of defense.&#160; The compliance program should include the following components&#58;</p><ol><li>Compliance Governance</li><li>Compliance Policies and Procedures</li><li>Compliance Staffing and Compensation</li><li>Compliance Monitoring, Testing, and Remediation</li><li>Compliance Communication and Training&#160;<br>&#160;</li></ol><p><strong>1)&#160;&#160;&#160;&#160;&#160; Compliance Governance</strong></p><p>The board should have an appropriate understanding of the types of compliance risks to which the Enterprise is exposed.<a href="#footnote6"><span style="text-decoration&#58;underline;">[6]</span></a>&#160; The board is responsible for exercising reasonable oversight to ensure that the compliance program is designed, implemented, reviewed, and revised in an effective manner.<a href="#footnote7"><span style="text-decoration&#58;underline;">[7]</span></a> &#160;The compliance program must be headed by a compliance officer<a href="#footnote8"><span style="text-decoration&#58;underline;">[8]</span></a> with the appropriate qualifications, experience, authority, accountability, and independence.<a href="#footnote9"><span style="text-decoration&#58;underline;">[9]</span></a>&#160; It should also be aligned with the enterprise-wide risk management program and board-approved risk appetites, including limits restricting exposures to third-party providers.<a href="#footnote10"><span style="text-decoration&#58;underline;">[10]</span></a>&#160; The board and senior management<a href="#footnote11"><span style="text-decoration&#58;underline;">[11]</span></a> should ensure that the compliance officer and the compliance program have adequate resources, including well-trained and capable staff.<a href="#footnote12"><span style="text-decoration&#58;underline;">[12]</span></a> &#160;</p><p>The board and senior management must discharge their duties and responsibilities in accordance with the Enterprise's code of conduct and ethics, and conduct themselves in a manner that promotes high ethical standards and a culture of compliance throughout the organization.<a href="#footnote13"><span style="text-decoration&#58;underline;">[13]</span></a>&#160; Promoting a culture of compliance includes documenting and communicating clear expectations about compliance both within the Enterprise and to third-party providers including sellers and servicers.&#160; The following activities are also part of an effective compliance culture&#58; clearly communicating the Enterprise's compliance, integrity, and business ethics standards and expectations; articulating the principle that employees and management conduct all activities in accordance with both the letter and the spirit of compliance obligations; and creating an environment where employees are encouraged to raise legal, compliance, and ethics questions and concerns without fear of retaliation.</p><p>The compliance officer must report directly to the chief executive officer<a href="#footnote14"><span style="text-decoration&#58;underline;">[14]</span></a> and should have sufficient resources and qualified staff to implement the compliance program.&#160; The compliance officer must also report regularly to the board.<a href="#footnote15"><span style="text-decoration&#58;underline;">[15]</span></a>&#160; At a minimum, these reports must address the adequacy of the Enterprise's compliance policies and procedures, including the entity's compliance with them.&#160; The compliance officer must recommend any revisions to such policies and procedures that he or she considers necessary or appropriate.<a href="#footnote16"><span style="text-decoration&#58;underline;">[16]</span></a> </p><p>First-line business functions own and manage compliance risks and implement corrective actions to address process and control deficiencies.&#160; The second line performs various risk control and compliance oversight functions.&#160; The scope and breadth of the activities of the compliance program should be subject to periodic review by the internal audit function.<a href="#footnote17"><span style="text-decoration&#58;underline;">[17]</span></a>&#160; The internal audit function's assessment of the effectiveness of the compliance program should be separate from the compliance function's monitoring and testing activities to ensure that the activities of the compliance function are subject to independent review.<a href="#footnote18"><span style="text-decoration&#58;underline;">[18]</span></a></p><p><strong>2)&#160;&#160;&#160;&#160;&#160; Compliance Policies and Procedures</strong></p><p>The processes and systems for managing compliance risk across the Enterprise should be documented in policies and procedures.&#160; The policies and procedures should also address compliance training throughout the organization.&#160; </p><p>Compliance policies should clearly articulate the roles and responsibilities of the various committees, functions, and staff with compliance responsibilities as well as the oversight role and responsibilities of the compliance officer and the board.&#160; These policies should describe the responsibilities of the compliance officer for managing and directing the implementation of the compliance program and the compliance officer's role in controlling compliance risks that transcend business lines.&#160; The policies should also address the scope of internal reporting of compliance matters to the board and senior management and the adequacy of the Enterprise's compliance policies and procedures, including the Enterprise's compliance with them.<a href="#footnote19"><span style="text-decoration&#58;underline;">[19]</span></a> </p><p style="text-align&#58;left;">The Enterprises should have policies and procedures in place to create an inventory of compliance obligations, identify new and revised compliance obligations, evaluate the impact to the business units, map obligations to internal controls, communicate changes with impacted parties and business units, promote independent reviews and escalation as necessary, and address compliance obligations in a practical and efficient way.&#160; </p><p style="text-align&#58;left;">Each Enterprise's compliance program should include compliance risk and control assessment policies and procedures designed to evaluate compliance risks associated with the Enterprise's business activities, including the development of new products and business practices.&#160; The compliance program's compliance risk assessment policies and procedures should include methods of measuring compliance risk (e.g. by using performance indicators) and use such measurements to enhance compliance risk assessments.</p><p style="text-align&#58;left;">Each Enterprise should have policies and procedures to file with FHFA any reports that may be required.<a href="#footnote20"><span style="text-decoration&#58;underline;">[20]</span></a><sup> </sup>&#160;&#160;These external reporting compliance policies and procedures should address conditions imposed in writing or written agreements between FHFA and the Enterprise.<a href="#footnote21"><span style="text-decoration&#58;underline;">[21]</span></a>&#160; </p><p style="text-align&#58;left;">The Enterprises should have first-line policies and procedures that are designed to implement enterprise-wide compliance policies and to integrate or “operationalize&quot; compliance obligations into day-to-day business processes, job duties, and responsibilities.&#160; First-line compliance policies and procedures should also promote independent reviews, identification of compliance issues, and escalation and tracking of identified issues.&#160; </p><p style="text-align&#58;left;">Procedures should describe the second-line compliance function's role in determining how business line compliance matters are addressed. &#160;Procedures for resolving disputes between the corporate compliance function and business line management regarding compliance matters should ensure that such disputes are resolved objectively.&#160; Under such procedures, the final decision-making authority should rest either with the corporate compliance function, or with a committee of senior management, including the compliance officer, that has no business line responsibilities.</p><p><strong>3)&#160;&#160;&#160;&#160;&#160; Compliance Staffing and Compensation</strong></p><p>The compliance officer should have appropriate qualifications, experience, authority, accountability, and independence.&#160; The compliance officer should have the necessary resources to implement the compliance function effectively.&#160; The compliance officer's compensation should include incentives tied to actions and outcomes within his or her control and influence and not include incentives that could impair or appear to impair the compliance program's independence.&#160; The compensation should also comply with 12 CFR Part 1230<a href="#footnote22"><span style="text-decoration&#58;underline;">[22]</span></a> as well as conform to the Enterprise's policies on compensation and performance management.</p><p>The Enterprise should have a sufficient number of staff assigned to the compliance function with requisite knowledge of business activities and compliance obligations to assess compliance risk and the effectiveness of risk controls.&#160; The compliance function may be centrally organized with dedicated staff or structured as a hybrid with first-line staff having both business and compliance responsibilities. &#160;In a hybrid approach, responsibilities for compliance activities may be delegated within the Enterprise, but oversight and ultimate responsibility for fostering an enterprise-wide compliance approach are borne centrally by the corporate compliance function.&#160; If a hybrid structure is used, compliance staff in the first line should have the ability and willingness to effectively challenge business operations regarding risk arising from the Enterprise's activities.&#160; The Enterprise should implement appropriate controls and enhanced second-line oversight to identify and address issues that may arise from conflicts of interest affecting compliance staff within the business lines. &#160;For example, in these circumstances, the Enterprise should adopt enhanced processes for the second-line compliance function's oversight of monitoring and testing activities performed by compliance staff within the business lines.&#160; In a hybrid structure, the second-line compliance function should also play a role in personnel actions and compensation decisions affecting first-line staff with compliance responsibilities.&#160; Compensation and incentive programs should avoid undermining the independence and objectivity of first-line compliance activity.&#160; </p><p><strong>4)&#160;&#160;&#160;&#160;&#160; Compliance Monitoring, Testing, and Remediation</strong></p><p>Compliance monitoring, testing, and remediation efforts should be risk-based, reflect the results of compliance risk assessments, and evaluate the adequacy and effectiveness of compliance activities across the organization.&#160; Testing and monitoring activities should provide information to compliance staff and senior executives about the operation of compliance controls across the organization, provide evidence to support an assessment of the operating effectiveness of the compliance program, and identify actual and potential instances of noncompliance.&#160; </p><p>Monitoring activities should identify control weaknesses that may fail to prevent or fail to identify noncompliance and should be designed to identify potential issues before a problem develops into noncompliance.&#160; These activities may include pre-activity approvals, transaction reviews, in-process quality checks, and outcome data reviews.&#160; The Enterprises' compliance programs should also include monitoring of third-party provider relationships to assess compliance with consumer protection-related laws and regulations and oversight of third-party providers' consumer compliance-related policies, procedures, internal controls, and training.<a href="#footnote23"><span style="text-decoration&#58;underline;">[23]</span></a>&#160; </p><p>Testing should assess the reliability of key assumptions, data sources, and procedures used in measuring and monitoring compliance risk.&#160; Controls should be tested on a periodic basis to ensure they are working as intended.&#160; If compliance controls are embedded in automated tools or business unit procedures, qualified compliance staff should review these tools and processes for consistency with entity-wide compliance policies and procedures.&#160; </p><p>The results of monitoring and testing activities should drive timely remediation of identified weaknesses. &#160;Corrective actions should be tracked and escalated as appropriate.&#160; Monitoring and testing protocols should include procedures for remedying undue delay in management response or ineffectual remediation efforts.</p><p><strong>5)&#160;&#160;&#160;&#160;&#160; Compliance Communication and Training </strong></p><p>The Enterprises should have lines of communication for employees to seek guidance and report concerns about compliance obligations.&#160; All Enterprise staff should receive specific, comprehensive compliance training appropriate to each individual's job responsibilities. &#160;Training should reinforce the Enterprise's written compliance risk management policies and procedures.&#160; When compliance policies are adopted or changed, the Enterprise should assess what, if any, training is appropriate.&#160; The Enterprise should determine whether the training should be conducted on an entity-wide or business unit level, who should be trained, and when the training should occur.</p><p> <br> <em><strong style="text-decoration&#58;underline;">Related Guidance and Regulations</strong></em></p><p>12 CFR Part 1230, Executive Compensation.</p><p>12 CFR Part 1236, Appendix, Prudential Management and Operations Standards.</p><p>12 CFR Part 1239, Responsibilities of Boards of Directors, Corporate Practices, and Corporate Governance.</p><p> <em><a href="/SupervisionRegulation/AdvisoryBulletins/Pages/Oversight-of-Third-Party-Provider-Relationships.aspx">Oversight of Third-Party Provider Relationships</a></em>, Federal Housing Finance Agency Advisory Bulletin 2018-08, September 28, 2018.</p><p> <em><a href="/SupervisionRegulation/AdvisoryBulletins/Pages/Oversight-of-Multifamily-SellerServicer-Relationships.aspx">Oversight of Multifamily Seller/Servicer Relationships</a></em>, Federal Housing Finance Agency Advisory Bulletin 2018-05, August 14, 2018.</p><p> <em><a href="/SupervisionRegulation/AdvisoryBulletins/Pages/Internal-Audit-Governance-and-Function.aspx">Internal Audit Governance and Function</a></em>, Federal Housing Finance Agency Advisory Bulletin 2016–05, October 7, 2016.</p><p> <em><a href="/SupervisionRegulation/AdvisoryBulletins/Pages/Fraud-Risk-Management.aspx">Fraud Risk Management</a></em>, Federal Housing Finance Agency Advisory Bulletin 2015-07, September 29, 2015.</p><p> <em><a href="/SupervisionRegulation/AdvisoryBulletins/Pages/Oversight-of-Single-Family-SellerServicer-Relationships.aspx">Oversight of Single-Family Seller/Servicer Relationships</a></em>, Federal Housing Finance Agency Advisory Bulletin 2014-07, December 1, 2014.</p><p> <em><a href="/SupervisionRegulation/AdvisoryBulletins/Pages/AB-2014-02-OPERATIONAL-RISK-MANAGEMENT.aspx">Operational Risk Management</a></em>, Federal Housing Finance Agency Advisory Bulletin 2014-02, February 18, 2014.</p><p> <em><a href="/SupervisionRegulation/AdvisoryBulletins/Pages/AB-2013-01-CONTINGENCY-PLANNING-FOR-HIGH-RISK-OR-HIGH-VOLUME-COUNTERPARTIES.aspx">Contingency Planning for High-Risk or High-Volume Counterparties</a></em>, Federal Housing Finance Agency Advisory Bulletin 2013-01, April 1, 2013.</p>&#160;&#160;&#160;&#160;&#160;&#160; <p>&#160;</p><hr width="25%" align="left" /><p> <a name="footnote1"><font color="#0066cc">[1]</font></a>&#160; 12 CFR 1239.12.</p><p> <a name="footnote2"> <font color="#0066cc">[2]</font></a>&#160; The regulation requires that the compliance program manage compliance with “applicable laws, rules, regulations, and internal controls,&quot; 12 CFR 1239.12.</p><p> <a name="footnote3"><font color="#0066cc">[3]</font></a>&#160; 12 CFR 1239.11(b), 1239.11(b)(2)(i), and 1239.11(c)(2).</p><p> <a name="footnote4"><font color="#0066cc">[4]</font></a>&#160; See <em>Oversight of Third-Party Provider Relationships, </em>AB 2018-08.&#160; See also PMOS, Standard 9&#58; Principles 4, 5, and 10.</p><p> <a name="footnote5"><font color="#0066cc">[5]</font></a>&#160; 12 CFR 1239.11(a).</p><p> <a name="footnote6"><font color="#0066cc">[6]</font></a>&#160; See generally PMOS, <em>Responsibilities of the Board of Directors&#58;</em> Principle 4.</p><p> <a name="footnote7"> <font color="#0066cc">[7]</font></a>&#160; Ibid.</p><p> <a name="footnote8"><font color="#0066cc">[8]</font></a>&#160; 12 CFR 1239.12.</p><p> <a name="footnote9"><font color="#0066cc">[9]</font></a>&#160;&#160; PMOS, Standard 1&#58; Principle 2 and Standard 8&#58; Principles 1 and 3.</p><p> <a name="footnote10"> <font color="#0066cc">[10]</font></a>&#160; See <em>Oversight of Third-Party Provider Relationships, </em>AB 2018-08.</p><p> <a name="footnote11"> <font color="#0066cc">[11]</font></a>&#160; Ibid.&#160; The term “senior management&quot; refers to those employees who plan, direct, and formulate policies, and provide the overall direction of the Enterprise for the development and delivery of products or services, within the parameters approved by the board.&#160; </p><p> <a name="footnote12"> <font color="#0066cc">[12]</font></a>&#160; PMOS, <em>General Responsibilities of the Board of Directors and Senior Management</em>&#58; Principle 6 and Standard 8&#58; Principle 6.</p><p> <a name="footnote13"> <font color="#0066cc">[13]</font></a>&#160; 12 CFR 1239.10(a).&#160; See also PMOS, Standard 1&#58; Principle 3. </p><p> <a name="footnote14"> <font color="#0066cc">[14]</font></a>&#160; 12 CFR 1239.12.</p><p> <a name="footnote15"> <font color="#0066cc">[15]</font></a>&#160; Ibid.</p><p> <a name="footnote16"><font color="#0066cc">[16]</font></a>&#160; Ibid.</p><p> <a name="footnote17"> <font color="#0066cc">[17]</font></a>&#160; See <em>Internal Audit Governance and Function, </em>AB 2016-05. &#160;See also PMOS, Standard 1&#58; Principle 14.</p><p> <a name="footnote18"> <font color="#0066cc">[18]</font></a>&#160; See generally PMOS, Standard 2.</p><p> <a name="footnote19"><font color="#0066cc">[19]</font></a>&#160; 12 CFR 1239.12.</p><p> <a name="footnote20"><font color="#0066cc">[20]</font></a>&#160; 12 CFR 1239.13.</p><p> <a name="footnote21"><font color="#0066cc">[21]</font></a>&#160; Ibid.</p><p> <a name="footnote22"><font color="#0066cc">[22]</font></a>&#160; As senior vice presidents, the Enterprises' compliance officers fit within the regulatory definition of executive officer.&#160; See 12 CFR 1230.2.</p><p> <a name="footnote23"><font color="#0066cc">[23]</font></a>&#160; PMOS, Standard 9&#58; Principles 4, 5, and 10.&#160; See also <em>Oversight of Third-Party Provider Relationships, </em>AB 2018-08.</p><p> <br>&#160;&#160;</p><table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width&#58;100%;"><p>FHFA has statutory responsibility to ensure the safe and sound operations of the regulated entities and the Office of Finance. &#160;Advisory bulletins describe FHFA supervisory expectations for safe and sound operations in particular areas and are used in FHFA examinations of the regulated entities and the Office of Finance. &#160;Questions about this advisory bulletin should be directed to&#58;&#160; <a>SupervisionPolicy@fhfa.gov</a>. </p></td></tr></tbody></table>10/3/2019 8:48:03 PMHome / Supervision & Regulation / Advisory Bulletins / Compliance Risk Management Advisory Bulletin This advisory bulletin (AB) communicates to Fannie Mae and Freddie Mac (the 4185https://www.fhfa.gov/SupervisionRegulation/AdvisoryBulletins/Pages/Forms/AllItems.aspxhtmlFalseaspx
Enterprise Fraud Reporting27298Fannie Mae & Freddie Mac9/18/2019 4:00:00 AMAB 2019-04<table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width&#58;100%;"><p> <strong>ADVISORY BULLETIN</strong></p><p> <strong>AB 2019-04&#58;&#160; ENTERPRISE FRAUD REPORTING</strong></p></td></tr></tbody></table><p> <span style="text-decoration&#58;underline;"><strong><em></em></strong></span>&#160;</p><p> <span style="text-decoration&#58;underline;"><strong><em>P<span style="text-decoration&#58;underline;"><strong><em>urpose</em></strong></span></em></strong></span></p><p>This advisory bulletin communicates to Fannie Mae and Freddie Mac (the Enterprises) the Federal Housing Finance Agency's (FHFA) fraud reporting requirements pursuant to 12 CFR Part 1233 (FHFA Regulation).</p><p>This advisory bulletin rescinds and replaces FHFA's Advisory Bulletin AB 2015-02&#58;&#160; <em>Enterprise Fraud Reporting</em>, dated March 26, 2015.</p><p style="text-decoration&#58;underline;"> <strong><em>Background</em></strong></p><p style="text-align&#58;left;">The Housing and Economic Recovery Act of 2008 (HERA) subjects the Enterprises to fraud reporting (12 U.S.C. Section 4642) and requires an Enterprise to submit to FHFA a “timely&quot; report upon discovery that it has purchased or sold a fraudulent loan or financial instrument, or when it suspects a possible fraud related to the purchase or sale of any loan or financial instrument.&#160; </p><p style="text-align&#58;left;">The FHFA Regulation implements the timely reporting requirement of HERA (12 CFR Section 1233.3(a)(1)) and requires immediate notification to the Director of FHFA upon the discovery of any situation that would have a significant impact on an Enterprise (12 CFR Section 1233.3(a)(2)).&#160; The FHFA Regulation grants the Director authority to determine procedures by which the Enterprises will submit such reports (12 CFR Section 1233.3(b)).</p><p style="text-decoration&#58;underline;"> <strong><em>Guidance</em></strong></p><p>The Enterprises should adhere to the guidelines in this advisory bulletin for reporting fraud or possible fraud to FHFA in compliance with the FHFA Regulation and for supervisory oversight purposes.&#160; &#160;</p><p> <em>Immediate Notification</em></p><p>To comply with the immediate notification requirement in the FHFA Regulation, an Enterprise should notify the Director's designee(s) electronically, through secure methods established by FHFA, within one calendar day from when an Enterprise becomes aware of fraud or possible fraud as defined in the FHFA Regulation that may have a significant impact on the Enterprise.&#160; Fraud or possible fraud is considered to have a significant impact if it may create substantial financial or operational risk for the Enterprise, whether from a single event/incident or because it is systemic.&#160; Fraud or possible fraud is also considered significant if it involves a member of the board of directors, officer, employee, or a contractor temporarily engaged to fill a position or perform a particular function at an Enterprise or other individual similarly engaged by an Enterprise.&#160; </p><p>The Enterprise should provide periodic updates to its board of directors, or a committee thereof, of all fraud or possible fraud requiring immediate notification.</p><p> <em>Timely Reporting</em></p><p>To comply with the timely reporting requirement in the FHFA Regulation, an Enterprise should adhere to the following two reporting requirements. </p><p> <span style="text-decoration&#58;underline;">Monthly Fraud Status Report</span></p><p>The Enterprises should submit a monthly fraud status report to FHFA. &#160;The monthly fraud status report shall contain requested information for each occurrence during the month in which the Enterprise has&#58;</p><ol><li>Filed a suspicious activity report (SAR) with the U.S. Department of the Treasury, Financial Crimes Enforcement Network (FinCEN) or</li><li>Discovered that it has purchased or sold a fraudulent loan or financial instrument, or when it suspects a possible fraud related to the purchase or sale of any loan or financial instrument, and the Enterprise has not filed a SAR.<br>&#160;</li></ol><p>FHFA will provide a template that describes the format of the monthly fraud status report and defines the information to be included.</p><p>Each Enterprise should provide the Director's designee(s) with the monthly fraud status report within thirty (30) calendar days after the end of each month, regardless of whether the Enterprise has a reportable event during the period covered by the report.&#160; The report should be sent electronically through secure methods established by FHFA.&#160; </p><p> <span style="text-decoration&#58;underline;">Quarterly Fraud Status Report</span></p><p>On a quarterly basis, the Enterprises should also report to FHFA summary information concerning their fraud risk management environments.&#160; </p><p>FHFA will provide a template that describes the format of the quarterly fraud status report and defines the information to be included.</p><p>Each Enterprise should provide the Director's designee(s) with the quarterly fraud status report within thirty (30) calendar days ​after the end of each calendar quarter.&#160; The report should be sent electronically through secure methods established by FHFA. &#160;<br></p><p> <span style="text-decoration&#58;underline;"><strong><em>Effective Date</em></strong></span></p><p style="text-align&#58;left;">This advisory bulletin becomes effective on January 1, 2020.&#160;​​<br>​<br></p><p style="text-decoration&#58;underline;"> <strong style="font-family&#58;&quot;source sans pro&quot;, sans-serif;font-size&#58;14px;"><em>​Related Guidance</em></strong><br></p><p> <em><a href="/SupervisionRegulation/AdvisoryBulletins/AdvisoryBulletinDocuments/AB2015-07_Fraud-Risk-Management.pdf">Fraud Risk Management</a></em>, Federal Housing Finance Agency Advisory Bulletin 2015-07, September 29, 2015.</p><table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width&#58;100%;"><p>FHFA has statutory responsibility to ensure the safe and sound operations of the regulated entities and the Office of Finance.&#160; Advisory bulletins describe FHFA supervisory expectations for safe and sound operations in particular areas and are used in FHFA examinations of the regulated entities and the Office of Finance. &#160;Questions about this advisory bulletin should be directed to&#58; <a href="mailto&#58;SupervisionPolicy@fhfa.gov">SupervisionPolicy@fhfa.gov</a>.</p></td></tr></tbody></table>9/18/2019 2:00:34 PMHome / Supervision & Regulation / Advisory Bulletins / Enterprise Fraud Reporting Advisory Bulletin This advisory bulletin communicates to Fannie Mae and Freddie Mac (the 2586https://www.fhfa.gov/SupervisionRegulation/AdvisoryBulletins/Pages/Forms/AllItems.aspxhtmlFalseaspx
Business Resiliency Management26708All5/7/2019 4:00:00 AMAB 2019-01<table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width&#58;100%;"><p style="text-align&#58;left;"> <strong>&#160;</strong><strong>ADVISORY BULLETIN</strong><strong>&#160; </strong></p><p style="text-align&#58;left;"> <strong>AB 2019-01&#58;</strong><strong>&#160; </strong><strong>BUSINESS RESILIENCY MANAGEMENT</strong></p></td></tr></tbody></table><p style="text-decoration&#58;underline;"> <br> <strong> <em>Purpose</em></strong></p><p>This advisory bulletin (AB) provides Federal Housing Finance Agency (FHFA) guidance on business resiliency management at Fannie Mae, Freddie Mac, the Federal Home Loan Banks (FHLBanks), and the Office of Finance (OF) (collectively, the regulated entities).<a href="#1">[1]</a>&#160; This AB rescinds and replaces Federal Housing Finance Board Advisory Bulletin 02-3 Disaster Recovery Planning, February 13, 2002.&#160; </p><p>For purposes of this AB, business resiliency management refers to the regulated entity's ability to minimize the impact of disruptions and maintain business operations at predefined levels. &#160;Disruptions can expose the regulated entities to operational, financial, legal, compliance, and reputational risks.&#160; An effective business resiliency management program (program) helps to ensure safe and sound operations at each regulated entity.&#160; </p><p style="text-decoration&#58;underline;"> <strong><em>Background</em></strong></p><p style="text-align&#58;left;">Uncontrolled events, such as natural disasters, pandemics, and cyberattacks, can threaten the regulated entities' ability to perform mission critical operations, such as providing liquidity and access to credit in the mortgage market.&#160; Disruptions in service can expose the regulated entities to a variety of risks and potentially lead to adverse economic consequences in the financial sector.&#160; A program establishes documented strategic processes and procedures that a regulated entity should follow to mitigate and respond to risks in order to continue its business operations. </p><p style="text-align&#58;left;">The core components of a program include the business continuity plan (BCP), disaster recovery plan (DRP) and crisis management plan (CMP) (collectively, plans).&#160; The BCP is the written set of procedures a regulated entity follows to recover, resume, and maintain business functions and their underlying processes at acceptable predefined levels following a disruption.&#160; The BCP accounts for disruptions affecting personnel, equipment, facilities, data, third-party providers, and the technical assets associated with business functions and processes.&#160; The DRP is the documented process to recover and resume the regulated entity's IT infrastructure, business applications, and data services in the event of a major disruption.&#160; The CMP provides documented, coordinated responses to enterprise-wide disruptions, including overseeing the activation of the DRP and BCPs. &#160;</p><p style="text-align&#58;left;">FHFA's general standards for safe and sound operations are set forth in the Prudential Management and Operations Standards (PMOS) at 12 CFR Part 1236 Appendix.&#160; Three relevant PMOS articulate guidelines for a regulated entity's board of directors and senior management to evaluate when establishing internal controls and information systems (Standard 1), overall risk management processes (Standard 8, especially Standard 8.11), and maintenance of adequate records (Standard 10). &#160;A business resiliency program that is aligned with this AB will meet FHFA's supervisory expectations on the points that the AB addresses, with respect to those standards.&#160; A business resiliency program that is not aligned with this AB may not meet those standards and may not be safe and sound.<a href="#2">[2]</a></p><p style="text-align&#58;left;text-decoration&#58;underline;"> <strong> <em>Guidance</em></strong></p><p>FHFA expects the regulated entities to establish and maintain a program that includes the following&#58;</p><ol style="list-style-type&#58;upper-roman;"><li>Governance</li><li>Business Resiliency Cycle</li><ol style="list-style-type&#58;upper-alpha;"><li>Risk Assessment and Business Impact Analysis</li><li>Risk Mitigation and Plan Development</li><li>Testing and Analysis</li><li>Risk Monitoring and Program Sustainability</li></ol></ol><p>Each regulated entity should establish its program in alignment with its enterprise-wide risk management program,<a href="#3">[3]</a> and in accordance with all relevant FHFA guidance.&#160; The regulated entity should develop strategies, policies, procedures, and internal standards that apply to the program.&#160; The program should guide the regulated entity to respond appropriately to disruptions affecting business operations, personnel, equipment, facilities, IT systems, and information assets.&#160; In order to remain current and effective, the program should adopt a cyclical, process-oriented approach that incorporates the following steps&#58; (1) risk assessment and business impact analysis, (2) risk mitigation and plan development, (3) testing and analysis, and (4) risk monitoring and program sustainability. &#160;</p><p> <strong>I.&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160; Goverance</strong></p><p>The board of directors or a committee thereof (board) is responsible for maintaining a strong business resiliency culture and overseeing the program.&#160; The board provides oversight of senior management's implementation of the program and maintenance of plans that reflect the regulated entity's current operating environment and risk appetite.&#160; The board should review and approve the enterprise-wide business resiliency strategic objectives of the program on an annual basis.&#160; &#160;</p><p>As delegated by the board, senior management<a href="#4">[4]</a> is responsible for executing the program.&#160; Senior management ensures that&#58;</p><ul style="list-style-type&#58;disc;"><li>Each step of the program is carried out by assigned personnel with clear roles and responsibilities;</li><li>There are designated resources and qualified personnel from across the regulated entity's business units and operations to develop and implement plans;&#160; </li><li>Employees are adequately trained and participate in testing exercises, as necessary, to demonstrate understanding of their role when plans are activated in the event of a disruption; </li><li>There is sufficient communication and coordination to properly execute plans and maintain enterprise-wide business resiliency;&#160; </li><li>Effective reporting and metric requirements are in place, such as reviewing internal audit reports and providing reports to the board;&#160; </li><li>The review and approval of plans involving critical business functions are conducted on an annual basis or when there are material changes in the operating environment that affect critical business functions; and</li><li>The board is informed of significant issues involving the strategies, plans, or testing of critical business functions. </li></ul><p> <strong>II.&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160; Business Resiliency Cycle</strong></p><p> <em>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160; A.&#160; Risk Assessment and Business Impact Analysis</em></p><p>Developing an effective plan begins with a risk assessment that determines the potential threats to a regulated entity's business operations.&#160; A risk assessment considers the full spectrum of scenarios that could affect operations, ranging from low impact, high probability occurrences (such as power or telecommunication disruptions) to low probability, high impact occurrences (such as pandemics or natural disasters).&#160; As part of the risk assessment process, the regulated entity should take into account disruptions involving information services, equipment, personnel, facilities, and services by third-party providers.&#160; The regulated entities should also consider their proximity to infrastructure in conjunction with their susceptibility to threats.&#160; </p><p>The business impact analysis (BIA) assesses and prioritizes those business functions and processes, including their associated technical assets, that must be recovered after a disruption.&#160; The BIA should identify the potential impact of uncontrolled events on the regulated entity's ability to execute its business functions and processes.&#160; The regulated entity should also consider the impact of disruptions on its ability to perform its role in the financial marketplace, satisfy legal and regulatory requirements, follow safe and sound practices, maintain public confidence, and achieve its strategic goals.&#160; </p><p>Conducting a thorough and accurate BIA is the basis for developing effective plans and a comprehensive program for the regulated entity.&#160; As part of the BIA, the regulated entities should identify business functions and processes, evaluate and compare business function requirements, and identify interdependencies between critical systems, departments, personnel, and services that may be compromised during a disruption.&#160; The BIA should be risk-focused, taking into consideration the priority of certain business functions and processes. &#160;The BIA should be conducted at least annually.&#160; </p><p>Recovery point objectives (RPOs) and recovery time objectives (RTOs) are calculated results informed by the BIA.&#160; An RPO defines the maximum level of data loss (in terms of time) that can be afforded during a failure.&#160; An RTO estimates the maximum allowable downtime for business processes and associated technical assets that should be recovered after a disruption.&#160; The regulated entity should additionally consider how RTOs and RPOs affect data recovery and reconciliation, especially when business and IT interdependencies are involved.&#160; RTOs inform the regulated entity on how it should categorize and group business processes and technical assets from the most critical functions to the least critical.</p><p> <em>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160; B.&#160; Risk Mitigation and Plan Development</em></p><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<span style="text-decoration&#58;underline;">Risk Mitigation</span></p><p>The regulated entity should use the results from the risk assessment and BIA to determine appropriate recovery solutions that mitigate the risk of a disruption to a level that is acceptable for its business functions and processes.&#160; The recovery solutions may include data synchronization, redundant vendor support, alternative power sources, high-availability technologies for critical business functions, fire detection and suppression systems, and additional reserves of critical equipment and supplies.&#160; The regulated entity should also consider the appropriate insurance coverage for its business, taking into consideration the BIA findings and its risk profile.</p><p>Some business functions have high availability requirements where even minimal downtime presents risk. &#160;The regulated entities should have an alternate, geographically distinct data center as an enterprise-wide disaster recovery solution that maintains availability within pre-determined RTOs and RPOs.&#160; Alternatively, the regulated entity can rely on its cloud service provider.<a href="#5">[5]</a>&#160; A geographically distinct data center should be at an appropriate distance from the regulated entity's primary operations and should not be subject to the same inherent risks as the primary site during a disaster.&#160; Pursuant to the DRP, the alternate site would be activated to recover, by priority, the technical assets of the primary location.&#160; The facility should be capable of operating at the regulated entity's normal volume and be available for use until the regulated entity achieves full recovery from the disaster. &#160;For any FHLBank, partnering with another FHLBank is a useful strategy for short-term resumption of certain business processes, but by itself should not be considered an adequate disaster recovery solution.&#160; </p><p>If a third-party provider is used to mitigate business resiliency risk, the regulated entity should evaluate, according to the risk assessment or BIA, whether its business resiliency objectives are met within its third-party provider risk management framework.<a href="#6">[6]</a>&#160; Commensurate with the risk involved, the regulated entity should consider the strength of a third-party provider's business resiliency program. </p><p>The regulated entities should also consider risk mitigation strategies in addition to those addressing RPOs and RTOs.&#160; For instance, a senior management-approved response plan to handle media inquiries can reduce the risk of reputational harm after a disruptive event.&#160; FHFA also encourages the regulated entities to contact federal, state, and local authorities as needed to determine specific risks or exposures for their geographic location and requirements for accessing emergency zones.&#160; The regulated entities should consider taking advantage of government-sponsored emergency programs and coordinating with agencies, emergency personnel, and service providers during the recovery and resumption of operations.</p><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160; <span style="text-decoration&#58;underline;">Plan Development</span></p><p>The regulated entity should document how to implement the risk mitigation strategies and recovery solutions in its plans.&#160; Plans should include short-term and long-term recovery operations with steps to transition back to normal business based on the criticality of the business functions and processes affected.&#160; Plans should also account for internal and external dependencies in the event that third-party providers,<a href="#7">[7]</a>&#160;personnel, or certain equipment are unavailable or inefficient.&#160; Plans should avoid single points of failure as the strength of a plan can be diminished by weak components. &#160;If the regulated entity outsources the development of its plans, it is responsible for choosing a service provider that has the requisite expertise appropriate for the entity's size, complexity, and risk environment.&#160;&#160; </p><p>The regulated entity's plans should include the following&#58;</p><ul style="list-style-type&#58;disc;"><li>The assumptions used to develop each plan, understanding that certain assumptions may not be met when a plan is activated;</li><li>Criteria to trigger activation of the plan and escalate incidents, if appropriate;</li><li>Assigned roles and responsibilities for personnel to activate and execute the plans;</li><li>Contingency plans for technical assets, where appropriate;</li><li>Incident response measures to protect the availability, confidentiality, and integrity of information;</li><li>Current contact information for employees, customers, service providers, municipal authorities, and emergency response personnel that is readily accessible at off-site locations; </li><li>Internal and external communication protocols, including notifying FHFA, the board, and customers, and call trees and employee notification procedures;</li><li>Relocation strategies to other facilities and remote access policies and standards if personnel are working from a remote location in the event of a disaster; and</li><li>References to emergency response measures to prevent loss of life and minimize injury and property damage.</li></ul><p>The regulated entity should prioritize the recovery of its business functions and processes according to the RTOs and RPOs as stated in each plan. &#160;Each business function, process, and associated technical asset should map to a BCP.&#160; Technical assets should also be accounted for in the DRP as they relate to the prioritized recovery and protection of the regulated entity's IT infrastructure, business applications, and data. &#160;The regulated entity should determine the enterprise-wide risk thresholds that trigger activating the CMP and the corresponding steps to respond to such incidents at an enterprise level.&#160; The regulated entity should consider the operational, legal, compliance, financial, and reputational risks involved when determining the thresholds to trigger the CMP.&#160; The CMP should include the coordinated responses to implement the DRP and BCPs, handle media inquiries, and oversee emergency response measures.</p><p> <em>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160; C.&#160; Testing and Analysis</em></p><p>Testing demonstrates how well each plan achieves the business resiliency objectives defined by the regulated entity.&#160; Each regulated entity should develop a testing program that includes policies, standards, and procedures that address test planning, execution, reporting of test results, and test revisions, as necessary.&#160;&#160;&#160; </p><p>Senior management should designate personnel to oversee the testing of plans and allocate adequate time and resources for test exercises.&#160; Senior management is also responsible for ensuring that employees are aware of their roles (i.e., administrator or participant) in executing tests regularly.&#160; Test plans should periodically rotate employee roles, as appropriate, to reduce reliance on specific individuals who may not be available during a disruptive event.&#160; Testing of plans involving critical business functions should be completed at least annually, and when material changes occur to the business operating environment.&#160; The frequency of testing should be consistent with the criticality of the business function, but should not jeopardize normal business operations.</p><p>Prior to each test, management should validate the testing methods to identify potential problems.&#160; Test plans or exercises should be evaluated to assess whether test objectives are feasible and whether assumptions used in developing the test strategy are reasonable.&#160; Testing of plans should align with the risk assessments and the BIAs to validate pre-determined RPOs and RTOs.&#160; Additionally, priority-based testing should&#58;</p><ul style="list-style-type&#58;disc;"><li>Incorporate a variety of threats, event types, and crisis management scenarios that range from isolated system failures to full-scale disruptions;</li><li>Evaluate identified internal and external interdependencies, including the testing of primary and alternate facilities with key third-party providers; </li><li>Progressively increase in scope and complexity, functions, physical locations, and participants; testing should ultimately process at least a full day's work at the regulated entity's normal levels;</li><li>Include a full-scale DRP test to confirm the entity's ability to conduct and sustain normal business in an alternate data center and the ability to return to pre-defined levels of operations in the primary data center; and</li><li>Over time, adapt to changes in the regulated entity's business activities and risk profile.&#160; </li></ul><p>Internal audit or a qualified independent third party should review the testing program and conduct an independent assessment of selected tests, including the underlying assumptions and methodology.&#160; Management should have oversight of key tests that are observed, verified, and evaluated by the independent party in order to validate the testing process and accuracy of test results.&#160; Test results, deviations from test plans, problems identified during testing, and any specified remediation steps should be properly documented. </p><p>Test results should be periodically analyzed to determine if problems identified during testing can be traced to a common source, remediated, and resolved through revisions to the testing program.&#160; Problems encountered during testing should be corrected and retested in a timely manner.&#160; Test participants or test owners can also provide suggestions to the test scenarios, plans or scripts to improve the test program.&#160; Once tests are completed and assessed, the test program should be updated to address any gaps identified during tests and retested, as necessary, for robustness and effective remediation within a reasonable timeframe.&#160; </p><p> <em>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160; D.&#160; Risk Monitoring and Program Sustainability</em></p><p>The regulated entity should also implement risk monitoring to track how changes to the business operating environment, including personnel, technologies, equipment, or third-party providers, may affect business resiliency strategies and plans.&#160;&#160; </p><p>Regular reports of test results and risk monitoring inform senior management of the effectiveness of the regulated entity's program.&#160; Senior management should use this information to determine if gaps exist between the risk assessment or BIA and the existing plans in place.&#160; Based on this gap analysis, RPOs and RTOs may need to be reassessed and risk mitigation strategies may need to be evaluated for particular plans.&#160; Management or plan administrators should revise plans based on test results or when material changes occur to the current business operating environment—including changes to personnel and internal and external dependencies, such as reliance on other business units or outsourced activities.&#160; Relevant business line managers and stakeholders should also be informed of test results so they can address material business resiliency problems identified during testing.&#160; The test and/or audit reports of third-party providers, lessons learned from an actual event, and any emerging risks identified should also be used in a gap analysis for each step of the program.&#160; Updates to plans should be completed in a timely manner and revised plans should be communicated and made available to appropriate managers and employees. </p><blockquote dir="ltr" style="margin-right&#58;0px;"> <strong> <em> <br>Related Guidance</em></strong></blockquote><blockquote dir="ltr" style="margin-right&#58;0px;"><blockquote dir="ltr" style="text-align&#58;left;margin-right&#58;0px;"><blockquote style="margin-right&#58;0px;"><p>12 CFR Part 1236 Prudential Management and Operations Standards, Appendix.<br><br><em>Oversight of Third-Party Provider Relationships</em>, Federal Housing Finance Agency Advisory Bulletin 2018-08, September 28, 2018.<br><br><em>Cloud Computing Risk Management</em>, Federal Housing Finance Agency Advisory Bulletin 2018-04, August 14, 2018.<br><br><em>Information Security Management</em>, Federal Housing Finance Agency Advisory Bulletin 2017-02, September 28, 2017.<br><br><em>Internal Audit Governance and Function</em>, Federal Housing Finance Agency Advisory Bulletin 2016-05, October 7, 2016.<br><br><em>Data Management and Usage</em>, Federal Housing Finance Agency Advisory Bulletin 2016-04, September 29, 2016.<br><br><em>Operational Risk Management</em>, Federal Housing Finance Agency Advisory Bulletin 2014-02, February 18, 2014. <br><br><em>Contingency Planning for High-Risk or High-Volume Counterparties</em>, Federal Housing Finance Agency Advisory Bulletin 2013-01, April 1, 2013. <br><br><em>Business Continuation Contingency Planning</em>, Federal Housing Finance Board Advisory Bulletin 03-2, February 10, 2003.<br><br><em>Disaster Recovery Planning</em>, Federal Housing Finance Board Advisory Bulletin 02-3, February 13, 2002 (rescinded by this advisory bulletin).&#160;<br><br></p></blockquote></blockquote></blockquote><table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width&#58;100%;"><p style="text-align&#58;left;">FHFA has statutory responsibility to ensure the safe and sound operations of the regulated entities and the Office of Finance.&#160; Advisory bulletins describe FHFA supervisory expectations for safe and sound operations in particular areas and are used in FHFA examinations of the regulated entities and the Office of Finance.&#160; <br>Questions about this advisory bulletin should be directed to&#58;&#160; <a href="mailto&#58;SupervisionPolicy@fhfa.gov">SupervisionPolicy@fhfa.gov</a>. </p></td></tr></tbody></table> <p> <u></u>&#160;</p><p> <a name="1">[1]</a>&#160;The OF is not a “regulated entity&quot; as the term is defined by statute (<em>see</em> 12 U.S.C. 4502(20)).&#160; However, for convenience, references to the “regulated entities&quot; in this AB should be read to also apply to the OF.&#160; </p><p> <a name="2">[2]</a>&#160;12 CFR 1236.4</p><p> <a name="3">[3]</a>&#160;12 CFR 1239.11(a).</p><p> <a name="4">[4]</a>&#160;The term “senior management&quot; refers to those employees who plan, direct, and formulate policies, and provide the overall direction of the regulated entity for the development and delivery of products or services, within the parameters approved by the board.</p><p> <a name="5">[5]</a>&#160;<em>See Cloud Computing Risk Management</em>, AB 2018-04.</p><p> <a name="6">[6]</a>&#160;<em>See Oversight of Third-Party Provider Relationships</em>, AB 2018-08.</p><p> <a name="7">[7]</a>&#160;Ibid.</p>5/7/2019 7:00:50 PMHome / Supervision & Regulation / Advisory Bulletins / Business Resiliency Management Advisory Bulletin This advisory bulletin (AB) provides Federal Housing Finance Agency 2871https://www.fhfa.gov/SupervisionRegulation/AdvisoryBulletins/Pages/Forms/AllItems.aspxhtmlFalseaspx
Oversight of Third-Party Provider Relationships25812All9/28/2018 4:00:00 AMAB 2018-08<div class="custom-contentTypeContent"><div aria-labelledby="ctl00_PlaceHolderMain_ctl04_label" style="display&#58;inline;"><table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width&#58;100%;"><p> <strong>​​​ADVISORY BULLETIN</strong></p><p> <strong>AB 2018-08&#58;&#160; OVERSIGHT OF THIRD-PARTY PROVIDER RELATIONSHIPS</strong></p></td></tr></tbody></table><p style="text-decoration&#58;underline;"> <strong><em><br>Purpose</em></strong></p></div></div><p>This advisory bulletin (AB) provides Federal Housing Finance Agency (FHFA) guidance to Fannie Mae<strong> </strong>and<strong> </strong>Freddie Mac, the Federal Home Loan Banks (FHLBanks), and the Office of Finance (OF) (collectively, the regulated entities<a href="#1">[1]</a>) on assessing and managing risks associated with third-party provider relationships.&#160; For the purposes of this AB, a third-party provider relationship is a business arrangement between a regulated entity and another entity that provides a product or a service.<a href="#2">[2]</a>&#160; When entering into third-party provider relationships, the regulated entities can be exposed to financial, operational, legal, compliance, and reputational risk.&#160; Effective risk management of third-party provider relationships is essential to the safe and sound operations of the regulated entities.&#160;</p><p style="text-decoration&#58;underline;"> <em><strong>Guidance</strong></em></p><p>FHFA expects each regulated entity to establish and maintain a third-party provider risk management program (program) that includes the following&#58;</p><ol style="list-style-type&#58;upper-roman;"><li>Governance</li><ol style="list-style-type&#58;upper-alpha;"><li>Responsibilities of the Board and Senior Management</li><li>Policies, Procedures, and Internal Standards</li><li>Reporting</li></ol><li>Third-Party Provider Risk Management Life Cycle Phases</li></ol><ol style="list-style-type&#58;upper-roman;"><ol style="list-style-type&#58;upper-alpha;"><li>Risk Assessment</li><li>Due Diligence in Third-Party Provider Selection</li><li>Contract Negotiation </li><li>Ongoing Monitoring</li><li>Termination</li></ol></ol><p style="text-align&#58;left;">A regulated entity's program should enable oversight of third-party provider relationships in accordance with the level of risk presented, the nature of the relationship, the scale of the outsourced product or service, and the risk inherent in the relationship.&#160; Because of this risk-based approach, aspects of this AB may not apply to every third-party provider relationship.&#160; The regulated entities should ensure that the quality and extent of third-party provider risk management corresponds with the level of risk and the complexity of these relationships.&#160; </p><p style="text-align&#58;left;">FHFA's general standards for safe and sound operations are set forth in the Prudential Management and Operations Standards (PMOS) at 12 CFR Part 1236 Appendix.&#160; Three relevant PMOS articulate guidelines for a regulated entity's board of directors and management to evaluate when establishing internal controls and information systems (Standard 1), overall risk management processes (Standard 8), and maintenance of adequate records (Standard 10).&#160; In addition, each regulated entity should manage its program as part of its enterprise-wide risk management program and in accordance with all relevant FHFA guidance.<a href="#3">[3]</a>&#160; </p><blockquote dir="ltr"><blockquote dir="ltr"><blockquote dir="ltr"><blockquote dir="ltr"><blockquote style="margin&#58;0px 0px 0px 40px;padding&#58;0px;border&#58;currentcolor;"><h4> &#160;I.&#160;&#160;&#160;&#160;&#160;&#160; Governance </h4><p> <em>A.&#160;&#160;&#160;&#160; Responsibilities of the Board and Senior Management</em></p></blockquote></blockquote><p style="text-align&#58;left;">The board of directors or board committee (board) should approve a policy establishing the program.&#160; The board-level policy (or management-level policies, as appropriate) should establish criteria for the acceptance and monitoring of risks related to third-party provider engagements and include enterprise-wide risk management processes that reflect the complexity of the regulated entity.&#160; Policies should assign clear roles and responsibilities to entity personnel, establish requirements for documenting decisions concerning third-party providers, and identify internal stakeholders throughout the third-party provider relationship.&#160; Internal audit, or an independent third party if specialized expertise is required, should audit the program periodically, including review of third-party assessments.</p><p>The regulated entity's board is responsible for oversight of the program, while senior management is responsible for executing the regulated entity's program and applicable policies on behalf of the board, consistent with established delegations.&#160; Each regulated entity's board should ensure that senior management has effective processes in place to manage risks related to third-party provider relationships, consistent with the regulated entity's strategic goals, organizational objectives, and risk appetite.&#160; </p><blockquote style="margin&#58;0px 0px 0px 40px;padding&#58;0px;border&#58;currentcolor;"><p> <em>B.&#160;&#160;&#160;&#160; Policies, Procedures, and Internal Standards</em></p></blockquote><p style="text-align&#58;left;">The regulated entities should establish and implement risk management processes in their policies that clearly define risk categories for the oversight of third-party provider relationships.&#160; Risk categories should consider the type and degree of risk inherent in the relationship, the scope and breadth of the third-party provider relationship, the nature of the product or service provided, and the ability to find an acceptable replacement for the third-party provider. &#160;In addition to categorizing these relationships, the regulated entity should document and consistently update its inventory of third-party providers.&#160; The regulated entity's program should articulate governance standards for risk-based due diligence, monitoring, and oversight that reflect the defined risk categories.&#160; The more risk a third-party provider relationship poses to the regulated entity, the more rigorously the regulated entity should perform these activities.&#160; Documentation requirements should correspond to the risk category or the nature of the third-party provider relationship.&#160; Other factors considered in establishing a risk-based approach include third-party provider relationships that could&#58; </p><ul style="list-style-type&#58;disc;"><li>Cause a regulated entity to face significant business, operational, legal, compliance, or reputational risk if the third-party provider fails to meet its obligations;</li><li>Require significant resources and costs to implement and manage the risk (such as a third-party provider that has an integral role in the regulated entity's operations or a financial technology firm that leverages emerging technologies); or</li><li>Have a major effect on the regulated entity's operations if it needs to procure an alternate third-party provider or has to perform the service in house.</li></ul><blockquote style="margin&#58;0px 0px 0px 40px;padding&#58;0px;border&#58;currentcolor;"><p> <em>C.&#160;&#160;&#160;&#160; Reporting</em> </p></blockquote><p> The regulated entity should implement a reporting system that provides management sufficient information to adjust the program, including policy, resources, expertise, and controls.&#160; Management should receive periodic reports from program stakeholders about commencing new third-party provider relationships, continuing existing ones, or terminating arrangements that do not meet expectations or no longer align with the goals of the regulated entity.&#160; Regular reports to management could incorporate the documentation of phases of the third-party provider relationship, such as analysis of costs, or reputational risks found during ongoing monitoring.&#160; Reports should contain sufficient detail to adequately inform the intended audience and sufficiently support related business decisions.</p><p> To assist the board in oversight of the program, management should provide the board with regular enterprise-wide reports on the regulated entity's management of risks associated with third-party providers.&#160; Management should also notify the board of significant third-party risks, such as business interruptions and terminations for cause, or third-party provider relationships that approach the regulated entity's risk appetite limits.&#160;&#160;</p><p>&#160;</p><blockquote style="margin&#58;0px 0px 0px 40px;padding&#58;0px;border&#58;currentcolor;"><h4>II.&#160;&#160;&#160;&#160;&#160;&#160;&#160; Third-Party Provider Risk Management Life Cycle Phases</h4></blockquote><p style="text-align&#58;left;">An effective program should include policies and procedures that cover all phases of the regulated entity's third-party provider relationship life cycle&#58; &#160;Risk Assessment, Due Diligence in Third-Party Provider Selection, Contract Negotiation, Ongoing Monitoring, and Termination.&#160; The scope and duration of each phase should be consistent with the program's policy, and multiple phases may be addressed simultaneously.&#160; The documentation for each phase is also dependent on whether the phase applies and the extent to which it applies. &#160;The life cycle phases are discussed in more detail below.&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160; <em></em></p><blockquote style="margin&#58;0px 0px 0px 40px;padding&#58;0px;border&#58;currentcolor;"><p> <em>A.&#160;&#160;&#160;&#160; Phase 1 – Risk Assessment </em></p></blockquote><p style="text-align&#58;left;">Each regulated entity's program should include processes to assess the risks associated with engaging a third-party provider to supply a product or service.&#160; These risks may include&#58;</p><ul style="list-style-type&#58;disc;"><li>The operational, compliance, legal, and reputational risks associated with having a third-party provider supply the product or service and the risk that expected benefits do not outweigh the costs;</li><li>The breadth of the products or services that would be delivered by a third-party provider;</li><li>Whether the regulated entity has adequate resources and expertise to monitor the third-party provider relationship;</li><li>The complexity of the arrangement, volume of activity, potential for a third-party provider's use of subcontractors, and the technology required; and</li><li>Potential information security risks associated with giving a third-party provider access to the regulated entity's operating location, information systems, or proprietary or personally identifiable information.</li></ul><p style="text-align&#58;left;">If the regulated entity establishes a third-party provider relationship, the program should provide for management of the associated risks.&#160; As necessary, the risk assessment should include a strategy for the regulated entity to procure adequate resources or expertise to mitigate the risks or justify acceptance of the identified risks.&#160; The regulated entity should review and update its risk assessment and revise risk mitigation strategies when appropriate.&#160; When documenting its risk assessment analysis, the regulated entity should indicate any risk assessment tools used in the process.</p><blockquote style="margin&#58;0px 0px 0px 40px;padding&#58;0px;border&#58;currentcolor;"><p> <em>B.&#160;&#160;&#160;&#160; Phase 2 – Due Diligence in Third-Party Provider Selection</em></p></blockquote><p style="text-align&#58;left;">Each regulated entity should conduct due diligence on a third-party provider before entering into a contract.&#160; The degree of due diligence should be commensurate with the level of risk of the outsourced activity and the complexity of the third-party provider relationship.&#160; A regulated entity should not rely solely on its prior experience or knowledge of the third-party provider as a substitute for an objective risk assessment of the third-party provider's ability to supply a product or service in a safe and sound manner.&#160; A regulated entity may refer to a third-party provider's independent audit, Service Organization Control (SOC) report, or recognized certifications to assess certain aspects of the third-party provider's internal risk management controls.&#160; Due diligence review should align with the severity of the risk.&#160; Due diligence results, findings, and recommendations should be documented.</p><p style="text-align&#58;left;">Due diligence prior to entering into a third-party provider relationship should include an evaluation of financial, operational, legal, compliance, and reputational risks of engaging the proposed third-party provider.&#160; As part of the due diligence review, the regulated entity should consider&#58; </p><ul style="list-style-type&#58;disc;"><li>Whether the proposed third-party provider can offer the product or service in compliance with applicable laws and regulations, as well as the regulated entity's internal policies, procedures, and other requirements;</li><li>The third-party provider's overall business model and how current and proposed business activities may affect the risks presented by the third-party provider; </li><li>The third-party provider's business background, experience, and reputation; </li><li>The financial performance, resources, and condition of the proposed third-party provider;</li><li>The third-party provider's insurance coverage;</li><li>The third-party provider's operational and internal controls, including information security, incident reporting and management, and business continuity programs; </li><li>Concentration risks that may arise from relying on a third-party provider for multiple products or services or from a third-party provider's reliance on subcontractors; </li><li>The extent to which the third-party provider relies on subcontractors to perform its obligations, the controls the subcontractor has in place, and the third-party provider's processes to oversee subcontractors that would be directly involved in the outsourced product or service; </li></ul><ul style="list-style-type&#58;disc;"><li>Any potential conflicts of interest with the directors, officers, or employees of the regulated entity concerning potential third-party providers;<a href="#4">[4]</a> and</li><li>Whether there are third-party fee structures that involve potential risks, such as incentives for inappropriate risk-taking, that could arise as a result of such fee structures.&#160; </li></ul><p style="text-align&#58;left;">Each regulated entity's third-party provider selection process should also be designed to ensure, to the extent possible and consistent with safety and soundness, the inclusion of&#160;minority-, women-, and disabled-owned businesses.<a href="#5">[5]</a></p><p style="text-align&#58;left;">Management should review the due diligence results to determine whether the third-party provider is able to adequately provide the product or service at a level of risk acceptable to the regulated entity.&#160; If the third-party provider cannot meet the regulated entity's requirements, management should consider whether to seek an alternate provider, supply the product or service itself, or mitigate the identified risks to the extent practicable. </p><blockquote style="margin&#58;0px 0px 0px 40px;padding&#58;0px;border&#58;currentcolor;"><p> <em>C.&#160;&#160;&#160;&#160;&#160;&#160; &#160;Phase 3 – Contract Negotiation </em></p></blockquote><p style="text-align&#58;left;">Each contract with a third-party provider should clearly specify the rights and responsibilities of each party.&#160; Consistent with the risk category involved, the regulated entity should consider what level of legal review is necessary for contracts with third-party providers and should ensure that the attorneys conducting the review for a particular contract have the appropriate subject matter expertise or work in conjunction with appropriate subject matter experts. &#160;Copies of executed contracts should be retained for reference and record-keeping purposes.</p><p style="text-align&#58;left;">The regulated entity should consider the following when negotiating contractual provisions with third-party providers&#58;</p><ul style="list-style-type&#58;disc;"><li>The nature and scope of service; </li><li>Duration of service; </li><li>Performance standards and service levels; </li><li>Experience requirements of third-party providers and their contractors;</li><li>Cost and compensation, including the timing and procedures for payment and expense reimbursement;</li><li>Confidentiality, use, location, and security of information; </li><li>Business continuity and contingency plans and test results;</li><li>Intellectual property ownership, rights, and responsibilities; </li><li>Timely disclosure of conflicts of interest or potential conflicts of interest from the third-party provider;</li><li>Incident reporting and management;</li><li>Dispute resolution process (<em>e.g.</em> arbitration, mediation), termination, and remedies; and</li><li>Internal controls and audit reports.</li></ul><p>The regulated entity should address what constitutes nonperformance and the conditions under which the contract may be terminated by either party.&#160; The contract should also stipulate the circumstances for and responsibilities when termination occurs.&#160; If the regulated entity could no longer legally engage a third-party provider,<a href="#6">[6]</a> the contract should include a provision that enables the regulated entity to terminate the contract for regulatory noncompliance.&#160; </p><p style="text-align&#58;left;">The regulated entity should also ensure that contracts address compliance with the specific laws, regulations, and guidance applicable to the regulated entity, including the regulated entity's right to obtain necessary information to conduct ongoing risk assessments, as well as monitor performance and ensure contract compliance.&#160; Contracts should also address whether the regulated entity has the right to conduct periodic on-site reviews to verify compliance.&#160; If contracts allow for subcontracting, the regulated entity generally should seek to ensure that the primary third-party provider remains responsible for the performance of its subcontractors in accordance with the terms of the primary contract, and be notified of the identity of any material subcontractors, when appropriate. </p><p style="text-align&#58;left;">Contracts for third-party providers should address, as appropriate, the provider's responsibility for continuation of the product or service in the event of an operational failure, such as man-made and natural disasters.&#160; Contracts should address requirements for third-party providers to back up information and maintain disaster recovery and contingency plans with sufficiently detailed operating procedures.&#160; </p><p style="text-align&#58;left;">Other issues such as the maintenance of adequate insurance, ownership of data or licenses, privacy, and liability limitations should be considered, as applicable.&#160; For example, the regulated entity should consider potential legal and security risks to cross-border data storage, transmission, and processing.&#160;&#160;&#160;</p><blockquote style="margin&#58;0px 0px 0px 40px;padding&#58;0px;border&#58;currentcolor;"><p> <em>D.&#160;&#160;&#160; Phase 4 – Ongoing Monitoring</em></p></blockquote><p style="text-align&#58;left;">The nature and extent of monitoring of the performance of third-party provider relationships should be commensurate with the level of risk.&#160; Management should also ensure that the regulated entity retains sufficient staff with the necessary expertise, authority, and accountability to oversee and monitor the third-party provider relationship.&#160; The approach (<em>e.g.</em>, on-site versus off-site review), depth, scope, and frequency of the monitoring and oversight activities should correspond to the risk category involved.&#160; If the regulated entity outsources any part of its monitoring and oversight, management is responsible for choosing a service provider appropriate for the entity's size, complexity, and risk environment.&#160; </p><p style="text-align&#58;left;">Ongoing monitoring should include the due diligence activities referenced in Phase 2 that apply to the particular third-party provider relationship.&#160; Management of the regulated entity should also consider whether the third-party provider is&#58;</p><ul style="list-style-type&#58;disc;"><li>Meeting service-level agreements, performance metrics, and other contractual terms; </li><li>Monitoring and evaluating subcontractor controls that are relevant to the contract work being performed;</li><li>Engaged in agreements with other entities that may pose a conflict of interest or present risks; </li><li>Performing periodic background checks; and</li><li>Complying with applicable legal and regulatory requirements, including documenting such compliance when necessary.</li></ul><p style="text-align&#58;left;">Because both the level and types of risks may change over the lifetime of a third-party provider relationship, a regulated entity should ensure that its ongoing monitoring adapts accordingly.&#160; Periodic assessments should be conducted to determine whether the product or service remains necessary or relevant to the regulated entity's mission or operations.&#160; Each regulated entity should also periodically assess existing third-party provider relationships to determine whether the nature of the product or service provided has changed, resulting in the need for re-designation to a new risk category. &#160;Management should review existing third-party provider contracts to determine whether the terms and conditions address current risks associated with having the product or service supplied by the third-party provider.&#160; Where concerns are identified, the regulated entity should consider addressing those concerns by negotiating an amendment to the contract where appropriate, or revising the contract prior to a renewal. &#160;</p><p style="text-align&#58;left;">When a regulated entity identifies concerns through ongoing monitoring, it should seek to resolve the issues at the earliest opportunity.&#160; Management should ensure procedures exist to escalate issues such as service agreement performance, material weaknesses and repeat audit findings, deterioration in financial condition, security breaches, data loss, or compliance lapses.&#160; Additionally, management should ensure that the regulated entity's controls for managing these risks from third-party provider relationships are tested regularly.&#160; Weaknesses identified that substantively increase the risk to the regulated entity should be reported to the board based on an assessment of the level of associated risk.</p><p style="text-align&#58;left;">Any assessments and analyses performed during this phase should be documented, as well as any regular risk management and performance reports received from the third-party provider (<em>e.g.</em>, audit reports, security reviews, and reports about compliance with service-level agreements).</p><blockquote style="margin&#58;0px 0px 0px 40px;padding&#58;0px;border&#58;currentcolor;"><p> <em>E.&#160;&#160;&#160;&#160; Phase 5 – Termination</em></p></blockquote><p style="text-align&#58;left;">The terms of each contract will govern how a regulated entity or a third-party provider may terminate the contractual relationship.&#160; A regulated entity may wish to terminate a third-party provider relationship for various reasons, including&#58;&#160;</p><ul style="list-style-type&#58;disc;"><li>Expiration, completion, or satisfaction of the contract;</li><li>Breach of contract;</li><li>To engage an alternate third-party provider;</li><li>To discontinue the product or service; </li><li>To bring the product or service in house; or</li><li>To comply with an FHFA order directing suspension of the third-party provider relationship. </li></ul><p style="text-align&#58;left;">Each regulated entity should have strategies and contingency plans in place to terminate third-party provider relationships in an efficient manner that minimizes risk to the regulated entity, whether the outsourced product or service is transitioned to another third-party provider, brought in house, or discontinued. The regulated entity should consider&#58;</p><ul style="list-style-type&#58;disc;"><li>The capabilities, resources, and time frames required to transition the product or service while still managing legal, regulatory, and other risks;</li><li>Risks associated with data retention and destruction, information system connections and access control issues, or other control concerns that require additional risk management and monitoring during and after the end of the third-party provider relationship;</li><li>Intellectual property ownership, rights, and responsibilities, as well as the handling of any joint intellectual property developed during the course of the arrangement; </li><li>The return of any regulated entity's information in the third-party provider's possession after voluntary or involuntary termination of the contract;</li><li>Reputational risks to the regulated entity if the termination results from the third-party provider's inability to meet expectations; and</li><li>Roles and assistance with transfer or wind down of the outsourced product or service upon termination.</li></ul><p style="text-decoration&#58;underline;"> <strong> <em>Related Guidance</em></strong></p><p>12 CFR Part 1236 Prudential Management and Operations Standards, Appendix. </p><p> <em>Cloud Computing Risk Management, </em>Federal Housing Finance Agency Advisory Bulletin 2018-04, August 14, 2018.</p><p> <em>Oversight of Multifamily Seller/Servicer Relationships</em>, Federal Housing Finance Agency Advisory Bulletin 2018-05, August 14, 2018.</p><p> <em>Information Security Management</em>, Federal Housing Finance Agency Advisory Bulletin 2017-02, September 28, 2017.</p><p> <em>Internal Audit Governance and Function</em>, Federal Housing Finance Agency Advisory Bulletin 2016-05, October 7, 2016.</p><p> <em>Data Management and Usage,</em> Federal Housing Finance Agency Advisory Bulletin 2016-04, September 29, 2016.</p><p> <em>Information Technology Investment Management,</em> Federal Housing Finance Agency Advisory Bulletin 2015-06, September 21, 2015.</p><p> <em>Oversight of Single-Family Seller/Servicer Relationships, </em>Federal Housing Finance Agency Advisory Bulletin, 2014-07, December 1, 2014.</p><p> <em>Operational Risk Management,</em> Federal Housing Finance Agency Advisory Bulletin, 2014-02, February 18, 2014. </p><p> <em>Model Risk Management, </em>Federal Housing Finance Agency Advisory Bulletin 2013-07, November 20, 2013.</p><p> <em>Contingency Planning for High-Risk or High-Volume Counterparties</em>, Federal Housing Finance Agency Advisory Bulletin 2013-01, April 1, 2013.</p><p>___________________________________________<br></p><p> <a name="1">[1]</a> The OF is not a “regulated entity&quot; as the term is defined by statute (<em>see </em>12 U.S.C. 4502(20)).&#160; However, for convenience, references to the “regulated entities&quot; in this AB should be read to also apply to the OF.&#160; </p><p> <a name="2">[2]</a> This AB does not apply to business arrangements through which a FHLBank provides products or services to its members or housing associates, or to a FHLBank's business arrangements with sponsors participating in its Affordable Housing Program.&#160; &#160;</p><p> <a name="3">[3]</a> 12 CFR 1239.11(a).</p><p> <a name="4">[4]</a> 12 CFR 1239.10(a).</p><p> <a name="5">[5]</a> 12 CFR 1223.2, 1223.21.</p><p> <a name="6">[6]</a><em>See, e.g.</em>, 12 CFR Part 1227.</p><table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width&#58;100%;"><p>FHFA has statutory responsibility to ensure the safe and sound operations of the regulated entities and the Office of Finance. Advisory bulletins describe FHFA supervisory expectations for safe and sound operations in particular areas and are used in FHFA examinations of the regulated entities and the Office of Finance. Questions about this advisory bulletin should be directed to&#58;&#160;<a href="mailto&#58;SupervisionPolicy@fhfa.gov.f">SupervisionPolicy@fhfa.gov</a>.</p></td></tr></tbody></table>​<br></blockquote></blockquote></blockquote>9/28/2018 6:30:25 PMHome / Supervision & Regulation / Advisory Bulletins / Oversight of Third-Party Provider Relationships Advisory Bulletin AB 2018-08:  OVERSIGHT OF THIRD-PARTY PROVIDER 7595https://www.fhfa.gov/SupervisionRegulation/AdvisoryBulletins/Pages/Forms/AllItems.aspxhtmlFalseaspx
Interest Rate Risk Management25813FHLB & Fannie Mae & Freddie Mac9/28/2018 4:00:00 AMAB 2018-09<div class="custom-contentTypeContent"><div aria-labelledby="ctl00_PlaceHolderMain_ctl04_label" style="display&#58;inline;"><table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width&#58;100%;"><p> <strong>​​​ADVISORY BULLETIN</strong></p><p> <strong>AB 2018-09&#58; INTEREST RATE RISK MANAGEMENT</strong></p></td></tr></tbody></table><p style="text-decoration&#58;underline;"> <strong><em><br>Purpose</em></strong></p></div></div><p>This advisory bulletin (AB) provides Federal Housing Finance Agency (FHFA) guidance for interest rate risk management at the Federal Home Loan Banks (Banks), Fannie Mae, and Freddie Mac (the Enterprises), collectively known as the regulated entities. &#160;This guidance supersedes the Federal Housing Finance Board's advisory bulletin, <em>Interest Rate Risk Management</em> (AB 2004-05).&#160; Interest rate risk management is a key component in the management of market risk.&#160; These guidelines describe principles the regulated entities should follow to identify, measure, monitor, and control interest rate risk. &#160;The AB is organized as follows&#58;</p><blockquote style="margin&#58;0px 0px 0px 40px;padding&#58;0px;border&#58;currentcolor;"><p>I.&#160;&#160;&#160;Governance</p></blockquote><blockquote style="margin&#58;0px 0px 0px 60px;padding&#58;0px;border&#58;currentcolor;"><p> A. Responsibilities of the Board</p><p> B. Responsibilities of Senior Management</p><p>C. Risk Management Roles and Responsibilities</p><p>D. Policies and Procedures</p></blockquote><blockquote style="margin&#58;0px 0px 0px 40px;padding&#58;0px;border&#58;currentcolor;"><p> II.&#160;&#160; Interest Rate Risk Strategy, Limits, Mitigation, and Internal Controls</p></blockquote><blockquote style="margin&#58;0px 0px 0px 60px;padding&#58;0px;border&#58;currentcolor;"><p>A. Limits</p><p>B. Interest Rate Risk Mitigation</p><p>C. Internal Controls</p></blockquote><blockquote style="margin&#58;0px 0px 0px 40px;padding&#58;0px;border&#58;currentcolor;"><p>III.&#160;Risk Measurement System, Monitoring, and Reporting</p></blockquote><blockquote style="margin&#58;0px 0px 0px 60px;padding&#58;0px;border&#58;currentcolor;"><p>A. Interest Rate Risk Measurement System</p><p>B. Scenario Analysis and Stress Testing</p><p>C. Monitoring and Reporting</p></blockquote><p> <span style="text-decoration&#58;underline;"> <strong> <em>Background</em></strong></span></p><p>Interest rate risk is the risk that changes in interest rates may adversely affect financial condition and performance.&#160; More specifically, interest rate risk is the sensitivity of cash flows, reported earnings, and economic value to changes in interest rates.&#160; As interest rates change, expected cash flows to and from a regulated entity change.&#160; The regulated entities may be exposed to changes in&#58;&#160; the level of interest rates; the slope and curvature of the yield curve; the volatilities of interest rates; and the spread relationships between assets, liabilities, and derivatives.&#160; Interest rate risk may include repricing risk, basis risk, option risk, option-adjusted spread (OAS) risk, prepayment risk, and model risk.&#160; Excessive interest rate risk can threaten liquidity, earnings, capital, and solvency.&#160; </p><p>The regulated entities can manage interest rate risk with respect to economic value of equity, earnings, or both. &#160;These approaches are complementary because they provide different types of relevant information, but each has limitations.&#160; The economic value of equity represents the underlying net market value (or net present value) of a regulated entity's assets and liabilities, including any off-balance sheet items.&#160; A common risk management objective is to keep the market value of equity from falling below pre-specified limits over a range of interest rate scenarios.&#160; One limitation of this approach is that market value measures do not identify when future earnings problems may occur.&#160; When the focus is on earnings, the risk management objective is to maintain earnings within an acceptable range over specified time horizons, which are generally short-term, ranging from one year to five years. &#160;If the objective is to ensure that net income will remain within certain parameters during the given time period over a range of interest rate scenarios, management overlooks risks that exist beyond the forecast horizon.</p><p>FHFA's general standards for safe and sound operations are set forth in the Prudential Management and Operations Standards (PMOS) at 12 CFR Appendix to Part 1236, four of which are relevant to managing interest rate risk.&#160; Standard 3 (Management of Market Risk Exposure) highlights the expectation for each regulated entity to have a clearly defined and well-documented strategy for managing market risk and establishes responsibilities for the board of directors or delegated board committee (board) and senior management.&#160; Standard 4 (Management of Market Risk – Measurement Systems, Risk Limits, Stress Testing, and Monitoring and Reporting) includes guidelines for market risk management in these areas.&#160; Standard 2 (Independence and Adequacy of Internal Audit Systems) and Standard 8 (Overall Risk Management Processes) include responsibilities for internal audit, the board, and senior management along with an independent risk management function. </p><p style="text-decoration&#58;underline;"> <strong><em>Guidance</em></strong></p><p>Each regulated entity's risk management practices should enable it to identify, measure, monitor, and control its interest rate risk exposures. &#160;An effective interest rate risk management function includes appropriate management of risk exposure, policies and procedures, risk limits, internal controls, risk measurement systems, monitoring, and reporting.&#160; A regulated entity should periodically review industry standards with regard to interest rate risk management.</p><h2><blockquote style="margin&#58;0px 0px 0px 40px;padding&#58;0px;border&#58;currentcolor;"><p> <strong>I.&#160;&#160;&#160;&#160;&#160;&#160; Governance</strong></p></blockquote></h2><p>The board and senior management should ensure that the regulated entity has in place appropriate policies, procedures, and internal controls for managing and controlling the regulated entity's exposure to interest rate risk.&#160; The board should oversee the adequacy of senior management's actions.&#160; Senior management should also ensure the regulated entity's risk measurement, monitoring, and reporting systems are reliable and effective.&#160; </p><blockquote style="margin&#58;0px 0px 0px 60px;padding&#58;0px;border&#58;currentcolor;"><p> <em>A.&#160;&#160;&#160;&#160; Responsibilities of the Board </em></p></blockquote><p>The board should oversee the adequacy of actions taken by senior management to identify, measure, manage, control, and report on interest rate risk exposures. &#160;The board should establish the regulated entity's tolerance for interest rate risk, approve major interest rate risk limits, and provide management with clear guidance regarding the level of acceptable interest rate risk.&#160; The board should approve major strategies and policies relating to the management of interest rate risk. &#160;The board should ensure such major strategies and policies are consistent with the regulated entity's overall business plan. </p><p>The board should review interest rate risk exposures on a periodic basis. &#160;Reports provided to the board should include appropriate details to allow the board to remain sufficiently informed about the nature and level of the regulated entity's interest rate risk exposures in light of current market conditions, established risk limits, operating performance, and other relevant factors.&#160; As a group, the board should have the requisite knowledge and background to assess the information provided and recommend further actions. </p><p>At least annually, or more frequently if there are significant changes in market or financial conditions, the board should review the interest rate risk management framework and major policies, limits, and internal controls. &#160;The regulated entity's risk tolerance; management's compliance with risk limits; results of stress tests; the level of the regulated entity's capital; and the effectiveness of the risk management framework, measurement systems, and reporting systems should inform the board's review of the risk limits.&#160; The board should document any changes to board-approved interest rate risk limits in its minutes.&#160; The board should also ensure that management takes appropriate corrective measures when interest rate risk limit breaches occur.&#160;&#160;&#160; </p><blockquote style="margin&#58;0px 0px 0px 60px;padding&#58;0px;border&#58;currentcolor;"><p> <em>B.&#160;&#160;&#160;&#160; Responsibilities of Senior Management</em></p></blockquote><p>Senior management implements board-approved strategies and policies relating to the management of interest rate risk.&#160; Senior management should ensure interest rate risk policies and procedures are clearly written, sufficiently detailed, adhered to, periodically reviewed, and should recommend updates for board approval, as appropriate.&#160; Senior management should ensure adequate organizational structure, systems, and resources are available to manage and control interest rate risk, and that personnel are appropriately trained and competent.</p><p>Senior management should periodically review and discuss with the board information regarding the nature and level of the regulated entity's interest rate risk exposures. &#160;Senior management should inform the board of how changing market conditions could affect interest rate risk exposure.&#160; The discussions should be sufficient in detail and timeliness to permit the board to understand and assess the management and control of the regulated entity's interest rate risk exposures.&#160; Senior management should report interest rate risk limit breaches to the board and identify appropriate remedial actions. &#160;Senior management should make the board aware of the advantages and disadvantages of the regulated entity's chosen interest rate risk management strategy and alternative strategies.&#160; </p><blockquote style="margin&#58;0px 0px 0px 60px;padding&#58;0px;border&#58;currentcolor;"><p> <em>C.&#160;&#160;&#160;&#160; Risk Management Roles and Responsibilities</em></p></blockquote><p>Policies and procedures should delineate the roles and responsibilities of persons assigned to measure, manage and control interest rate risk so they operate with sufficient independence from the business units, as applicable. &#160;&#160;</p><p>Business units encounter interest rate risk on a daily basis and should follow policies and procedures when taking steps to manage and maintain interest rate risk within approved limits.&#160; Senior management, through an asset and liability management (or similar) committee, is responsible for managing and controlling interest rate risk. </p><p>The risk management function, or unit, is responsible for interest rate risk measurement, risk monitoring, and independent oversight, including the establishment and enforcement of board-approved interest rate risk limits.&#160; It should also be responsible for ensuring that the business units have effective processes in place to identify, assess, monitor, and report on key interest rate risks. The chief risk officer must report regularly to the risk committee and to the chief executive officer.<a href="#1">[1]</a>)</p><p>Internal audit should conduct periodic evaluations of internal controls around interest rate risk management. &#160;Internal audit should conduct risk-based audits of the regulated entity's interest rate risk management and determine whether management promptly addresses findings or weaknesses regarding interest rate risk management.&#160; Internal audit should review adherence to interest rate risk management policies and procedures. </p><blockquote style="margin&#58;0px 0px 0px 60px;padding&#58;0px;border&#58;currentcolor;"><p> <em>D.&#160;&#160;&#160; Policies and Procedures</em></p></blockquote><p>A regulated entity should have interest rate risk management policies and procedures appropriate for its risk profile.&#160; This includes being clearly written, sufficiently detailed, formally approved at the appropriate level, and, as applicable, periodically reviewed by the board and senior management.&#160; Approved policies and procedures should include defined interest rate risk limits and assign lines of authority and responsibility for managing interest rate risk. &#160;Procedures should exist for monitoring compliance with limits and to follow up on instances of noncompliance or breaches.&#160; &#160;&#160;</p><p>Management should ensure that policies and procedures to identify and manage inherent risks are sufficient before undertaking new products, offerings, or activities.&#160; </p><p>The regulated entity should also have policies and procedures for any management, ad hoc, or “on top&quot; adjustments to model-generated interest rate risk metrics, and provide clear instructions on needed approvals and documentation requirements.&#160; The documentation should explain the adjustment and the reason it is necessary as well as how long it will be required.&#160; The regulated entity's enterprise risk management or another authorized management risk committee should be made aware of, and approve, any major management, ad hoc, or “on top&quot; adjustments to interest rate risk metrics.</p><h2><blockquote style="margin&#58;0px 0px 0px 40px;padding&#58;0px;border&#58;currentcolor;"><p> <strong>II.&#160;&#160;&#160;&#160;&#160;&#160; Interest Rate Risk Strategy, Limits, Mitigation, and Internal Controls</strong></p></blockquote></h2><p>A regulated entity should have a clearly defined and well-documented strategy for managing and mitigating interest rate risk, consistent with its overall business plan.&#160; The regulated entity should identify, manage, monitor, and control interest rate risk exposures on a business unit and an enterprise-wide basis.</p><p>It is incumbent on the regulated entity to understand the adopted strategy's impact on financial condition, whether the objective is to control risk to economic value of equity, earnings, some other target, or a combination thereof.&#160; Overemphasis on one approach may not be optimal and may lead to problems over time.&#160; For example, meaningful declines in the market value of equity to the book value of equity ratio, prospective earnings, or related indicators may signal interest rate risk management weaknesses, even if these declines occur within the context of low reported risk and compliance with approved policies and limits.</p><blockquote style="margin&#58;0px 0px 0px 60px;padding&#58;0px;border&#58;currentcolor;"><p> <em>A.&#160;&#160;&#160;&#160; Limits</em></p></blockquote><p>A regulated entity should establish an interest rate risk framework that includes interest rate risk metrics, a comprehensive set of board-approved interest rate risk limits, and management threshold levels, set below board limits, to serve as warning triggers and initiate discussion regarding risk levels. &#160;The risk limits should be consistent with the regulated entity's risk profile, profitability objectives, and liquidity and capital needs.&#160; Limits should not be set so far above actual risk exposures that they are meaningless or have no effect on risk taking behavior. &#160;The regulated entity should also maintain a record of all limit breaches.</p><p>Different metrics used for setting interest rate risk limits may include, as applicable&#58; &#160;duration of equity, convexity of equity, volatility duration, market value sensitivity to yield curve parallel moves and twists, key-rate duration, maturity gap of assets and liabilities, prepayment duration, spread duration, market value of equity to par value of capital stock, market value of equity to book value of equity, retained earnings, net interest income sensitivity, and Value at Risk.&#160; A regulated entity should understand the advantages and disadvantages of the interest rate risk limits framework it has chosen to utilize.</p><blockquote style="margin&#58;0px 0px 0px 60px;padding&#58;0px;border&#58;currentcolor;"><p> <em>B.&#160;&#160;&#160;&#160; Interest Rate Risk Mitigation</em></p></blockquote><p>A regulated entity should mitigate interest rate risk to keep risks within approved levels and should be able to identify problems that occur even when risks are within approved levels.&#160; For example, a regulated entity should be able to recognize significant accumulating losses from interest rate risk, explain the causes of losses, and manage risk exposure at some point even if the regulated entity is in compliance with approved strategy, policies, and limits.&#160; </p><p>A regulated entity can mitigate interest rate risk through a variety of strategies including&#58; matched funding, funding with debt having embedded options, hedging using derivatives, and building retained earnings. &#160;Matched funding allows a regulated entity to match the maturity of its assets and liabilities. &#160;Funding with debt having embedded options could allow regulated entities to mitigate exposures of assets with explicit and implicit options such as mortgages.&#160; Hedging using derivatives allows the regulated entity to mitigate interest rate risk by changing its cash flows and economic exposure stemming from certain changes in interest rates. &#160;Building retained earnings allows the regulated entity to have a larger capital base to absorb the impact of an adverse interest rate change.&#160; Having a robust net interest income stream also allows a regulated entity to absorb the effects of adverse interest rate movements. </p><blockquote style="margin&#58;0px 0px 0px 60px;padding&#58;0px;border&#58;currentcolor;"><p> <em>C.&#160;&#160;&#160;&#160; Internal Controls </em></p></blockquote><p style="text-align&#58;left;">A regulated entity should have sufficient internal controls around interest rate risk management.&#160; The internal control process should aim to ensure effective and efficient management of interest rate risk; reliable measurement of interest rate risk; reliable reporting and communication of interest rate risk; and compliance with applicable statutes, regulations, and policies governing interest rate risk.&#160; Additionally, internal controls should support periodic reviews and evaluations of policies and procedures as well as the accuracy and reliability of risk measurement systems.</p><p style="text-align&#58;left;">A regulated entity should monitor the adequacy and effectiveness of its internal controls and information systems on an ongoing basis through a formal self-assessment process.&#160; Business units, enterprise risk management, and internal audit should conduct periodic evaluations of internal controls for interest rate risk management. &#160;</p><h2><blockquote style="margin&#58;0px 0px 0px 40px;padding&#58;0px;border&#58;currentcolor;"><p> <strong>III.&#160;&#160;&#160;&#160;&#160;&#160; Risk Measurement System, Monitoring, and Reporting</strong></p></blockquote></h2><p>The regulated entities should choose which method(s) to use to measure interest rate risk. &#160;Methods may include&#58; Duration Analysis, Earnings Simulation Analysis, Earnings at Risk, Capital at Risk, Value at Risk, Economic Value of Equity, or other methods. &#160;Generally, a regulated entity would measure interest rate risk by valuing its assets, liabilities, derivatives, and off-balance sheet exposures in different interest rate environments.&#160; A regulated entity should understand the advantages and disadvantages of its chosen interest rate risk measurement method(s). </p><blockquote style="margin&#58;0px 0px 0px 60px;padding&#58;0px;border&#58;currentcolor;"><p> <em>A.&#160;&#160;&#160;&#160; Interest Rate Risk Measurement System </em></p></blockquote><p>A regulated entity should have an interest rate risk measurement system (<em>i.e.</em>, a model or set of models) that captures all material sources of interest rate risk, including repricing risk, yield curve risk, basis risk, prepayment risk, and option risk. &#160;The sophistication of the risk measurement system should be commensurate with the complexity of the financial instruments held by the regulated entity.&#160; The risk measurement system should also provide meaningful and timely measures of the regulated entity's risk exposures and use generally accepted financial concepts, valuation methodologies, and risk measurement techniques. &#160;</p><p>The risk measurement system should be capable of valuing all of the regulated entity's assets and liabilities, including off-balance sheet positions and derivatives, and estimating the effect of changes in interest rates and other key risk factors on the regulated entity's earnings and market value of equity over a range of scenarios.&#160; A regulated entity should properly document and bring to management's attention instances where the risk measurement system cannot reliably value an instrument or requires a model workaround.&#160; Any management, ad hoc, or “on top&quot; adjustments to model output should be made according to approved procedures.&#160; The measurement system should use directly or indirectly observed market prices for its estimates of market values where feasible.&#160; A regulated entity should test new products to verify the risk measurement system can properly measure the exposure of the new product.&#160; </p><p>Periodically, enterprise risk management or another authorized management risk committee should review the interest rate risk measurement system for accuracy and reliability, including comparison to actual portfolio behaviors when feasible.&#160; Management should ensure the integrity and timeliness of the data inputs used to measure interest rate risk exposures and that assumptions and parameters are reasonable and properly documented.&#160; Management should also understand strengths and weaknesses of the model(s) used, including sensitivity to changes in key assumptions. &#160;</p><blockquote style="margin&#58;0px 0px 0px 60px;padding&#58;0px;border&#58;currentcolor;"><p> <em>B.&#160;&#160;&#160;&#160; Scenario Analysis and Stress Testing</em></p></blockquote><p style="text-align&#58;left;">A regulated entity should routinely conduct scenario analysis as a part of interest rate risk management as it relates to market value measures and net income measures.&#160; Scenarios should include increasing and decreasing parallel and nonparallel interest rate shocks of varying magnitudes as well as an instantaneous and gradual steepening and flattening of the yield curve.&#160; The regulated entity should also consider changes in prepayment speeds for mortgage-related instruments, volatility for securities impacted by interest rate volatility, and relevant interest rate spreads for different securities.&#160; The scenarios should identify the main exposures within a regulated entity's interest rate risk profile.&#160; A regulated entity could perform analysis to identify which assumptions or inputs cause the largest impact. </p><p>A regulated entity should perform periodic stress testing of interest rate risk management positions. &#160;The stress scenarios should include interest rate shocks and shifts in the economic environment that are of a magnitude such that it tests the effectiveness of the interest rate risk management of the regulated entity.&#160; These stress scenarios should vary over time.&#160; The regulated entity should include scenarios conducted for its annual strategic business plan or annual stress testing as applicable. </p><p style="text-align&#58;left;">The regulated entity should give special consideration to financial instruments or markets where it has significant concentrations, financial instruments in which a regulated entity's position may be more difficult to unwind or hedge during periods of market stress, and complex financial instruments with embedded options that may be more difficult to evaluate in stressful scenarios.</p><p style="text-align&#58;left;">If management or the board finds the results from the scenario analysis or stress testing unacceptable, management should determine a course of action and may need to modify, rebalance, or hedge so that performance would be acceptable under the identified scenarios.&#160; The board and senior management should periodically review the design of the stress tests to ensure that they capture conditions where the regulated entity is most vulnerable.</p><blockquote style="margin&#58;0px 0px 0px 60px;padding&#58;0px;border&#58;currentcolor;"><p> <em>C.&#160;&#160;&#160;&#160; Monitoring and Reporting</em></p></blockquote><p>A regulated entity should routinely monitor and report interest rate risk exposures using scenario analysis to business unit managers, senior management, and the board at a level appropriate for each.&#160; The interest rate risk reports should be accurate, informative, and timely.&#160; The reports should show adherence to approved interest rate risk policies and limits and any exceptions or breaches of limits and policies. The reports should identify and explain limit breaches. </p><p>The interest rate risk reports should reflect and show trends in measures used to evaluate interest rate risk management objectives.&#160; Reports should show the market value of the regulated entity's assets, liabilities, and off-balance sheet exposures, including derivatives, under a range of scenarios.&#160; With respect to earnings, reports should show net income over a specified time horizon under various scenarios. &#160;Reports should also include backtesting results to compare past forecasts, or risk estimates, with actual results. &#160;&#160;</p><p>Interest rate risk reports should identify any changes to risk models and model assumptions, describe the rationale for the changes, and analyze their impact on risk measures and risk limits.&#160; Interest rate risk reports should also note any management, ad hoc, or “on top&quot; adjustments to interest rate risk models, the reason for the adjustment, and the start and expected end date for the use of the adjustment.&#160; </p><p style="text-decoration&#58;underline;"> <strong><em>Related Guidance</em></strong></p><p> <em>Model Risk Management Guidance, </em>Federal Housing Finance Agency, Advisory Bulletin AB-2013-07, November 20, 2013.</p><p> <em>Internal Audit Governance and Function</em>, Federal Housing Finance Agency, Advisory Bulletin AB-2016-05, October 7, 2016.</p><p>Appendix to 12 CFR Part 1236 - Prudential Management and Operating Standards.&#160; </p><p>12 CFR Part 1239 – Responsibilities of Board of Directors, Corporate Practices, and Corporate Governance.&#160; </p><p>________________________<br></p><p> <a name="1">[1]</a> 12 CFR 1239.11(c)(5)&#160;&#160; </p><table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width&#58;100%;"><p>FHFA has statutory responsibility to ensure the safe and sound operations of the regulated entities and the Office of Finance. Advisory bulletins describe FHFA supervisory expectations for safe and sound operations in particular areas and are used in FHFA examinations of the regulated entities and the Office of Finance. Questions about this advisory bulletin should be directed to&#58;&#160;<a href="mailto&#58;SupervisionPolicy@fhfa.gov.f">SupervisionPolicy@fhfa.gov</a>.</p></td></tr></tbody></table>​<br> 9/28/2018 6:35:25 PMHome / Supervision & Regulation / Advisory Bulletins / Interest Rate Risk Management Advisory Bulletin AB 2018-09: INTEREST RATE RISK MANAGEMENT The AB is organized as follows 3851https://www.fhfa.gov/SupervisionRegulation/AdvisoryBulletins/Pages/Forms/AllItems.aspxhtmlFalseaspx
Liquidity Risk Management25675Fannie Mae & Freddie Mac8/22/2018 4:00:00 AMAB 2018-06<table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width&#58;100%;"><p> <strong>​ADVISORY BULLETIN</strong></p><p> <strong>AB 2018-06</strong><br></p><p> <strong>LIQUIDITY RISK MANAGEMENT</strong><br></p></td></tr></tbody></table><p></p> <br> <p> <strong style="text-decoration&#58;underline;"><em></em></strong></p><p style="text-decoration&#58;underline;"><strong><em>Purpose&#160;</em></strong></p><p>This advisory bulletin (AB) communicates to Fannie Mae and Freddie Mac (the Enterprises) the Federal Housing Finance Agency’s (FHFA) guidance for the management of liquidity risk. Strong liquidity risk management supports safe and sound operations by enabling the Enterprises to meet their financial obligations when they come due without incurring unacceptable losses.&#160;</p><p>This advisory bulletin summarizes the principles of sound liquidity risk management, and, where appropriate, aligns with the regulation of other financial intermediaries. FHFA expects the Enterprises to use liquidity metrics that are commensurate with their funds management strategies and provide a comprehensive view of their liquidity risk to ensure that sufficient funds are available at a reasonable cost to meet potential demands.&#160;</p><p>This AB supersedes AB 2014-01 (<em>Liquidity Risk Management</em>).&#160;</p><p> <br> </p><p style="text-decoration&#58;underline;"><strong><em>Background&#160;</em></strong></p><p>Liquidity risk is the risk that an Enterprise will be unable to meet its financial obligations as they come due without incurring unacceptable losses. Strong liquidity risk management enables an Enterprise to be financially sound to perform its public mission and to limit and control shortfalls in cash. The guidance emphasizes the importance of cashflow projections, diversified funding sources, stress testing, a cushion of liquid assets, and a formal, well-developed contingency funding plan as primary tools for measuring and managing liquidity risk.&#160;</p><p>The standards for safe and sound operations for the Enterprises are set forth in the Prudential Management and Operations Standards (PMOS) at 12 CFR part 1236. Standard 5 (Adequacy and Maintenance of Liquidity and Reserves) states that each Enterprise should establish a liquidity management framework, articulate liquidity risk tolerances; and establish a process for identifying, measuring, monitoring, controlling, and reporting its liquidity position and liquidity risk exposures. In addition, Standard 5 includes guidelines for conducting stress tests to identify sources of potential liquidity strain and guidelines for establishing contingency funding plans.&#160;</p><p>Standard 8 (Overall Risk Management Processes) states the expectation for the Enterprises to establish risk management practices that measure, monitor, and control liquidity risk. The PMOS describe responsibilities of boards of directors and management for all Standards.</p><p>&#160;</p><p style="text-decoration&#58;underline;"><strong><em>Guidance&#160;</em></strong></p><p>Each Enterprise is expected to be able to identify, measure, monitor, control, and report its liquidity exposures by accurately identifying both existing and emerging risks, and quantifying the primary sources of liquidity risk. Effective liquidity risk management should include&#58;&#160;</p><ul><li>Adequate board of directors (board) and senior management oversight;&#160;<br></li><li>Appropriate liquidity management policies, procedures, and limits;&#160;<br></li><li>Appropriate risk measurement methodology, monitoring, and reporting systems; and&#160;<br></li><li>An effective contingency funding plan.&#160;<br></li></ul><p>The Enterprise should address risks unique to it with regard to liquidity, such as access to debt markets and the ability to sell or repurchase securities during a crisis.&#160;<br></p><p><strong>Board of Directors and Senior Management Oversight&#160;</strong></p><p>An Enterprise’s board is ultimately responsible for the liquidity risk assumed by the Enterprise and for guiding the strategic direction of liquidity risk management. The board, or a committee thereof, should establish and approve appropriate liquidity risk tolerances and limits, and oversee management’s establishment and approval of liquidity management strategies, policies, and procedures. The board should review these at least annually. In addition, the board is expected to have an understanding of the Enterprise’s business activities and associated liquidity risk. The board should understand the cash inflows and outflows that dictate an Enterprise’s liquidity needs (e.g., trust remittance cycle, guarantee fee, cash window, and mortgage purchase commitments). The board is expected to ensure that senior management has the necessary expertise to effectively manage liquidity risk. <a href="#1">[1]</a>​&#160;</p><p>Senior management oversees the daily and long-term management of liquidity risk. As part of an effective liquidity risk management program, senior management&#58;&#160;<br></p><ul><li>Develops liquidity risk management strategies, policies, and practices for approval by the board;&#160;<br></li><li>Implements sound internal controls for managing liquidity risk;&#160;<br></li><li>Establishes effective information systems and contingency funding plans; and&#160;<br></li><li>Establishes reporting systems that produce timely and accurate information on the Enterprise’s liquidity position and sources of risk exposure, including concentration risk, and provides regular reports to the board.&#160;<br></li></ul><p>These responsibilities may be delegated to a board-approved management committee.&#160;<br></p><p>The Enterprise’s organizational structure should clearly assign responsibility, authority, and relationships for managing liquidity risk and management should ensure that personnel are competent and appropriately trained with regard to the Enterprise’s established systems, policies and tolerances.&#160;</p><p>FHFA expects a Treasury unit to be responsible for the ownership and management of the liquidity risk limits. The unit should also be responsible for the identification, assessment, mitigation, control, monitoring, and reporting of liquidity risk, and for the Enterprise’s adherence to risk policies, standards, and limits.&#160;</p><p>A risk management unit should be responsible for the independent oversight and monitoring of liquidity risk. The risk management unit’s responsibilities would normally include&#58;&#160;</p><ul><li>Ensuring that risk limits for liquidity risk are meaningful, assessing liquidity risk against key risk indicators;&#160;<br></li><li>Independently reporting on liquidity risk issues;&#160;<br></li><li>Escalating liquidity risk breaches;&#160;<br></li><li>Stress testing liquidity risk limits;&#160;<br></li><li>Providing senior management and the board with reports on liquidity risk management and gaps between supervisory guidance, industry sound practices, and practices at the Enterprise; and&#160;<br></li><li>Ensuring that the Treasury unit has an effective process in place to identify, assess, monitor, and report on key liquidity risks.&#160;<br></li></ul><p><strong>Appropriate Liquidity Management Policies, Procedures, and Limits&#160;</strong><br></p><p>A robust set of liquidity risk management policies would appropriately include&#58;&#160;</p><ul><li>Standards regarding day-to-day operational liquidity needs;&#160;<br></li><li>Plans for dealing with contingent liquidity needs, including potential temporary, intermediate-term, and long-term liquidity disruptions;&#160;<br></li><li>Board-established liquidity risk tolerances, and procedures establish steps to manage the risk exposures within those limits.<br></li><li>Methodology for determining the Enterprise’s operational and contingency liquidity needs;&#160;<br></li><li>Characteristics of investments that can be held for liquidity purposes;&#160;<br></li><li>Identification of investments that can be liquidated with minimal loss during times of stress;&#160;<br></li><li>Provisions for documenting and periodically reviewing assumptions used in liquidity projections;&#160;<br></li><li>Contingency funding plan for the Enterprise’s ability to access capital markets during periods of market stress; and&#160;<br></li><li>The nature and frequency of liquidity risk reporting for management and the board.&#160;<br></li></ul><p>Liquidity risk tolerances or limits should be appropriate for the complexity and liquidity risk profile of the Enterprise and should employ quantitative targets. These limits, tolerances, and guidelines will be most effective if they include items such as&#58;&#160;<br></p><ul><li>Discrete or cumulative cashflow mismatches or gaps (sources and uses of funds) over specified future short- and long-term time horizons under both expected and adverse business conditions. These may be expressed as cashflow coverage ratios or as specific aggregate amounts;&#160;<br></li><li>Target amounts of unpledged, high-quality liquid asset reserves expressed as aggregate amounts or as ratios;&#160;<br></li><li>Asset concentrations, especially with respect to more complex exposures that are illiquid or difficult to value, e.g. the size of the position relative to the depth of the market;&#160;<br></li><li>Funding concentrations that address diversification issues, such as dependency on a few sources of borrowed funds; and&#160;<br></li><li>Contingent liability metrics, such as amounts of unfunded commitments and lines of credit relative to available funding.&#160;<br></li></ul><p><strong>Appropriate Risk Measurement Methodology, Monitoring, and Reporting Systems</strong>&#160;<br></p><p>FHFA expects an Enterprise’s measurement of liquidity to include metrics for intraday liquidity, short-term cash needs (e.g., 30 days), access to collateral to manage cash needs over the medium term (e.g., 365 days), and a general congruence between the maturity profiles of the assets and liabilities. An Enterprise should also consider common industry practices and regulatory standards. <a href="#2">[2]</a>&#160;</p><p>FHFA expects that an Enterprise’s measurement systems should reasonably measure liquidity exposures, identify potential liquidity shortfalls, and simulate various market scenarios, including stress scenarios. Measurement systems should include robust models for projecting cashflows and an Enterprise’s liquidity needs over appropriate time horizons, ranging from intraday to longer-term liquidity needs of one year or more. These systems are expected (i) to measure tenor, liquidation costs, time to liquidate assets, and liquidity provider concentrations to ensure that reliance on certain funding structures or sources of funds is appropriately identified and controlled, and (ii) to capture all significant on- and off-balance sheet items and be adjusted as products or risks change.&#160;<br></p><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p><em>A. Cashflow Modeling&#160;</em></p></blockquote><p>Since an Enterprise’s cashflows depend on choices mortgage borrowers make to prepay or extend their obligations, managing liquidity risk will be facilitated by the Enterprises’ use of pro forma cashflow statements. Pro forma cashflow analysis can be used to project sources and uses of funds under various liquidity scenarios to identify potential funding gaps. In determining potential liquidity needs and risk management strategies, the possibility of losses and deterioration in valuations from potential credit and market events should be considered. The Enterprise should account for this in assessing the feasibility and impact of asset sales on its liquidity position during stress events. Stress events should include national and regional events and cases where the catastrophic events occur simultaneously. The Enterprise should be able to calculate all of its collateral positions in a timely manner, including the value of assets currently pledged relative to the amount of security required and unencumbered assets available to be pledged. The Enterprise should be aware of the operational and timing requirements associated with accessing collateral given its physical location (i.e., the custodian entity or securities settlement system with which collateral is held). The Enterprise should also fully address the potential demand for additional collateral arising from various types of contractual contingencies during periods of both market-wide and Enterprise idiosyncratic stress.&#160;<br></p><p>To capture a variety of stresses, management's pro forma cashflow analysis should incorporate multiple scenarios that consider the general and unique risks faced by the Enterprise.&#160;</p><p>Assumptions used in pro forma cashflow projections should be reasonable and appropriate, adequately documented, and periodically reviewed by the appropriate risk management unit and the model oversight group at the Enterprises. Assumptions should consider a wide range of potential outcomes with regard to the stability of borrowings and securitization. Sensitivity tests&#160;</p><p>should be performed to measure the effects that material changes to assumptions would have on related accounts.&#160;</p><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p><em>B. Management Reporting&#160;</em></p></blockquote><p>To effectively fulfill senior management’s responsibilities with respect to liquidity risk management, it is necessary that senior management receive sufficient reports on Enterprise’s liquidity risk management. An Enterprise should generate such reports at least monthly, including the level and trend of the Enterprise’s liquidity risk; and to report to the board, or a board committee, quarterly. If liquidity risk is high, or if it is moderate and increasing, more frequent reports are likely to be called for. Reportable items may include&#58;&#160;<br></p><ul><li>Cashflow gaps;&#160;<br></li><li>Asset and funding concentrations;&#160;<br></li><li>Critical assumptions used in cashflow projections;&#160;<br></li><li>Key early warning or risk indicators;&#160;<br></li><li>Funding availability;&#160;<br></li><li>Status of contingent funding sources; and&#160;<br></li><li>Collateral usage.&#160;<br></li></ul><p><strong>Contingency Funding Plan (CFP)&#160;</strong><br></p><p>Funding decisions can be influenced by unplanned events. Such events include the inability to fund asset growth; difficulty renewing or replacing funding as it matures;<a href="#3">[3]</a>​ the exercise of options by customers to prepay or to draw down lines of credit; legal or operational risks; the demise of a business line; and market disruptions. Funding and investment strategies that are concentrated in one or two business lines or relationships, such as the Enterprises’ strategies, typically are at greater risk of being disrupted by adverse events.&#160;</p><p>An Enterprise should examine contracts and arrangements associated with major lines of business and funding sources to identify low-probability/high-impact events that could adversely affect liquidity. Contingency plans that incorporate practical solutions that can be adopted quickly to address such contingencies as they arise will minimize exposure to such events.&#160;</p><p>An Enterprise’s CFP should be customized to the liquidity risk profile of the Enterprise, and should identify the types of stress events which may be faced. The overall impact of a given stress event should be considered, including both direct and indirect effects. To be effective in mitigating foreseeable stress events, the CFP should&#58;&#160;</p><ul><li>Define responsibilities and decision-making authority so that all personnel understand their role during a problem-funding situation;&#160;<br></li><li>Include an assessment of the possible liquidity events that an Enterprise might encounter;&#160;<br></li><li>Detail how management will monitor for liquidity events, typically through stress testing of various scenarios in a pro forma cashflow format; and&#160;<br></li><li>Identify and assess the adequacy of contingency funding sources. The plan should identify any back-up facilities (lines of credit), the conditions and limitations to their use, and the circumstances where the Enterprise might use such facilities. Management should understand the various legal, financial, and logistical constraints, such as notice periods, collateral requirements, or net worth covenants, that could affect the Enterprise’s ability to use back-up facilities. They should test back-up facilities annually.&#160;<br></li></ul><p>CFPs are particularly important in institutions such as the Enterprises that rely on securitization. This is because an Enterprise’s income is generated from its volume of business. The Enterprises have contracts to purchase fixed volumes of loans from mortgage originators, and they are dependent on the To Be Announced (TBA) market to generate corresponding cash inflows. CFPs are expected to address scenarios where securitization or asset sales become rapidly unavailable. The Enterprise should have plans in place to address disruptions in the capital markets that would result in delayed sales of loans as well as required increases in retained interests and other credit enhancements.&#160;</p><div>​<br></div><p></p><p style="text-decoration&#58;underline;"> <strong><em>Related Guidance&#160;</em></strong></p><p>12 CFR part 1720 Safety and Soundness Standards, August 30, 2002.&#160;</p><p>12 CFR part 1236 Prudential Management and Operations Standards, Appendix.&#160;</p><p>12 CFR Part 249 Liquidity Coverage Ratio&#58; Liquidity Risk Measurement Standards, October 10, 2014.&#160;</p><p>12 CFR part 1239 Responsibilities of Boards of Directors, Corporate Practices, and Corporate Governance, December 21, 2015.&#160;<br></p><p>Proposed Rule on Net Stable Funding Ratio&#58; Liquidity Risk Measurement Standards and Disclosure Requirements, 81 FR 35124 through 35183, June 1, 2016.&#160;</p><p><em>Model Risk Management Guidance</em>, Federal Housing Finance Agency Advisory Bulletin 2013-07, November 20, 2013.&#160;</p><p><em>Liquidity Risk Management</em>, Federal Housing Finance Agency Advisory Bulletin 2014-01, February 18, 2014 (superseded).<br></p><p> <br> </p><hr /> <br> <p> <a name="1">[1]</a> Liquidity risk management policies and procedures should establish the roles and responsibilities of groups involved in liquidity risk management, and have clear escalation procedures in the event of a breach of the liquidity limits. This would include board-level risk limits and action plans in the event of a breach of risk limits. The standards for board governance in 12 CFR part 1239, FHFA’s Corporate Governance Rule, were issued November 2015. Section 1239.11 addresses risk management.</p><p></p><p> <a name="2">[2]</a> On October 10, 2014, the Office of the Comptroller of the Currency, the Board of Governors of the Federal Reserve System, and the Federal Deposit Insurance Corporation collectively issued a final rule that implemented a quantitative liquidity requirement, the Liquidity Coverage Ratio (LCR). 12 CFR part 50 (OCC); 12 CFR part 249&#160; (Regulation WW) (Federal Reserve Board); 12 CFR part 329 (FDIC). On June 1, 2016, the FFIEC interagency rule for the <a href="https&#58;//www.occ.gov/news-issuances/federal-register/81fr35124.pdf">Net Stable Funding Ratio&#58; Liquidity Risk Measurement Standards and Disclosure Requirements​</a> (NSFR) was proposed. 81 FR 35124 through 35183 (June 1, 2016). These sources address issues of short term liquidity (e.g., the adequacy of high quality assets holdings) and scale of mismatch of cashflows over the intermediate term. As of this date, the Net Stable Funding Ratio has not been adopted, but the proposal remains a useful reference point.&#160;</p><p> <a name="3">[3]</a> Critical rollover needs can be identified using funding ladders.<br></p><p> <br> </p><table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width&#58;100%;"><p>FHFA has statutory responsibility to ensure the safe and sound operations of the regulated entities and the Office of Finance. Advisory bulletins describe FHFA supervisory expectations for safe and sound operations in particular areas and are used in FHFA examinations of the regulated entities and the Office of Finance. Questions about this advisory bulletin should be directed to&#58; <a href="mailto&#58;SupervisionPolicy@fhfa.gov">SupervisionPolicy@fhfa.gov​</a>.<br></p></td></tr></tbody></table>​<br><br>8/22/2018 9:23:35 PMHome / Supervision & Regulation / Advisory Bulletins / Liquidity Risk Management Advisory Bulletin This advisory bulletin (AB) communicates to Fannie Mae and Freddie Mac (the 3612https://www.fhfa.gov/SupervisionRegulation/AdvisoryBulletins/Pages/Forms/AllItems.aspxhtmlFalseaspx
Cloud Computing Risk Management25572All8/15/2018 4:00:00 AMAB 2018-04<table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width&#58;100%;"><p> <strong>​​​​​​ADVISORY BULLETIN</strong></p><p> <strong>AB 2018-04</strong><br></p><p> <strong>CLOUD COMPUTING RISK MANAGEMENT​</strong><br></p></td></tr></tbody></table>​<br> <p></p><p><strong style="text-decoration&#58;underline;"><em>Purpose​</em></strong><br></p><p>This advisory bulletin provides Federal Housing Finance Agency (FHFA) guidance to Fannie Mae, Freddie Mac, the Federal Home Loan Banks (FHLBanks), and the Office of Finance (OF) (collectively, the regulated entities)&#160; on assessing and managing risks associated with third-party cloud providers.&#160; Effective risk management of cloud providers is critical to safe and sound operations.&#160; Each regulated entity should use a risk-based approach across key areas listed below to meet FHFA supervisory expectations&#58;​<br></p><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p>I.&#160;Governance</p></blockquote><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p>A. Responsibilities of the Board and Senior Management</p></blockquote><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p>B. Strategies, Policies, Procedures, and Internal Standards</p></blockquote></blockquote><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p>II. Third-Party Cloud Provider Management</p></blockquote><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p>A. Due Diligence Assessment</p></blockquote><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p>B. Service Agreements</p></blockquote><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p>C. Oversight and Ongoing Monitoring</p></blockquote></blockquote><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p>III. Information Security</p></blockquote><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p>A. Shared Responsibility for Security</p></blockquote><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p>B. Data Classification and Systems Security</p></blockquote><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p>C. Access Management</p></blockquote><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p>D. Incident Notification, Planning, and Response</p></blockquote><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p>E. Development and Testing Environments&#160;</p></blockquote></blockquote><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p>IV. Business Continuity Cloud Provider Management<br></p><p><br></p></blockquote><p><strong style="text-decoration&#58;underline;"><em>Background</em></strong></p><p><strong style="text-decoration&#58;underline;"><em></em></strong>Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.&#160; This model is composed of five essential characteristics (on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service), three service models (Software as a Service or SaaS, Platform as a Service or PaaS, and Infrastructure as a Service or IaaS), and four deployment models (private cloud, community cloud, public cloud, and hybrid cloud).</p><p>Relationships between cloud customers and their cloud providers are complex.&#160; Critical information and resource controls may shift from in-house operations to a third party, meaning the regulated entity and cloud provider share responsibility for safeguarding organizational information and systems.&#160; Additionally, cloud providers may have privileged access to organizational systems and information.&#160; Because of this shared responsibility, a regulated entity engaging with a cloud provider should take appropriate steps to manage associated third-party risks and revise the information security program to address risks specific to cloud computing.&#160; A regulated entity should also prepare for outages and failures that may hinder access to organizational information and systems that rely on cloud providers.<br></p><p>FHFA’s general standards for safe and sound operations are set forth in the Prudential Management and Operations Standards (PMOS) at 12 CFR Part 1236 Appendix.&#160; Three relevant PMOS articulate guidelines for a regulated entity’s board of directors and management to evaluate when establishing internal controls and information systems (Standard 1), overall risk management processes (Standard 8), and maintenance of adequate records (Standard 10).<br><br></p><p><strong style="text-decoration&#58;underline;"><em>Guidance</em></strong></p><p>FHFA expects each regulated entity to appropriately manage its cloud computing risks as part of its enterprise-wide risk management program,&#160; and in accordance with all relevant FHFA guidance.&#160; Application of this guidance by the regulated entity should correspond to the level of risk presented.&#160; The regulated entity’s evaluation of the level of risk should include the classification of the data hosted at the cloud provider, the criticality of the service(s) provided, service and deployment models used, and other risks associated with engaging a third-party cloud provider.</p><p>The regulated entity may establish a standalone cloud computing risk management program or subsume the governance and functions of cloud computing risk management under another established program.&#160; The complexity of and level of risk associated with the regulated entity’s cloud usage should inform the decision on whether the cloud computing risk management program should exist as a standalone program or is subsumed into other program(s).&#160; Because cloud computing affects several different areas of operations, those responsible for managing related risks should coordinate across different divisions to manage the third-party provider, information security, and business continuity risks.​<br></p><p><strong>I. Governance</strong></p><p>The governance of the cloud computing risk management program should consist of the cloud strategy, policies, procedures, and internal standards.&#160; If the regulated entity subsumes the governance of the cloud computing risk management program into other programs, the regulated entity should clearly communicate which strategies, policies, procedures, and internal standards apply.&#160; The complexity of and level of risk associated with the regulated entity’s cloud usage should inform whether the board or senior management approves the cloud computing strategy, policies, procedures, and internal standards.</p><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p><em>A. Responsibilities of the Board and Senior Management</em></p></blockquote><p>The board of directors or a committee thereof (board) should provide oversight to the cloud computing risk management program.&#160; As part of that oversight, the board should understand the risks involved in the regulated entity’s use of cloud computing.&#160; The board should ensure that senior management fully understands the effects of shifting to a cloud computing environment and has appropriate expertise on managing those effects prior to engaging a cloud provider.&#160; The board should review the strategy or strategic plan that covers cloud computing and major policies relating to associated risks.</p><p>Senior management should develop and periodically update policies, procedures, and internal standards and implement the cloud computing risk management program.&#160; Senior management should also periodically report to the board about the nature of the regulated entity’s cloud computing risk, which may change significantly over time.</p><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p><em>B. Strategies, Policies, Procedures, and Internal Standards</em></p></blockquote><p>Each regulated entity should establish and periodically update its cloud computing strategy, and evaluate its appetite for associated risks.&#160; The regulated entity’s current and planned cloud usage, including the extent and purpose, the classification of data stored on the cloud, and the choice of cloud service and delivery model, should inform the development of individual policies, procedures, and internal standards.&#160; Policies should describe appropriate uses for cloud computing.&#160; The regulated entity should evaluate and update policies, procedures, and internal standards so they are consistent with the cloud strategy and the regulated entity’s risk appetite.</p><p>The regulated entity should develop or update internal standards as a basis for managing and monitoring risks at levels consistent with the regulated entity’s risk appetite.&#160; The internal standards should establish the technical and operational criteria the regulated entity uses to evaluate cloud provider service agreements and controls, including criteria on performance and reliability in terms of availability, security, business continuity, and compliance.&#160; Where possible, internal standards should include metrics.&#160; The regulated entity should consider industry standards as well as its needs, capabilities, and risk appetite to inform the development of its internal standards.<br></p><p><strong>II. Third-Party Cloud Provider Management</strong></p><p>The regulated entities should take steps to mitigate the third-party risks arising from their use of cloud providers.&#160; The shared responsibility framework, heightened administrative privileges, standardized service model, and potential for vendor lock-in of cloud providers, result in new risks and complications to existing risks.&#160;</p><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p><em>A. Due Diligence Assessment</em></p></blockquote><p>In addition to an evaluation of financial, operational, legal, compliance, and reputational risks of engaging the cloud provider, the regulated entity should evaluate whether and how shifting to a cloud computing environment affects risk.&#160; If warranted under the circumstances, the assessment should include a comparison with other cloud providers that offer comparable services.&#160; The results of due diligence assessments should frame service agreement negotiations and the regulated entity’s procedures and operations for managing provider-specific cloud computing risks.</p><p>The on-demand self-service and rapid elasticity of cloud service have the potential to result in substantial changes to the risks associated with a specific cloud provider when the service agreement has not changed.&#160; Consequently, due diligence assessments should occur for every cloud provider at contract inception and prior to any modifications in the level or type of services obtained that could result in significant increases to the regulated entity’s risk exposure.&#160; Policies on the frequency of due diligence assessments should also consider the rapid evolution in the market for cloud services.</p><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p><em>B. Service Agreements</em></p></blockquote><p>Recognizing that each cloud computing use, complexity, and risk is unique, the details of the service agreement provisions may vary.&#160; Because cloud providers often use a standardized service model, the regulated entity may not be able to negotiate changes to the selected cloud provider’s standard service agreement.&#160; In cases where there are differences between the chosen cloud provider’s service agreement and the regulated entity’s policies and internal standards, the regulated entity should first consider alternative providers.&#160; If a regulated entity determines that no alternatives exist that meet the business need, the regulated entity should develop plans to mitigate or transfer any risks emanating from the differences to reduce the risk to an acceptable level.​</p><p>Service agreements with a cloud provider should define roles and responsibilities of the cloud provider and regulated entity.&#160; Service agreements should not restrict information technology, information security, and business continuity teams from effectively performing their responsibilities in the cloud environment, including monitoring and evaluating performance, protecting against and responding to security incidents, and supporting ongoing risk and compliance management.<br></p><p>Prior to executing a cloud computing service agreement, legal and information security experts who are knowledgeable about cloud computing should review the agreement to determine if the agreement exposes the regulated entity to unacceptable levels of risk.&#160; The review should include an assessment of significant contractual risk points for cloud computing, such as the dispute resolution process, confidentiality provisions, privacy policy, data residency, and any limitations on liability, indemnities, termination rights, and suspension rights.&#160; Additionally, the review should include a determination of whether and how the cloud provider may use regulated entity data for its own purposes.&#160; In accordance with a regulated entity’s policies and procedures, the regulated entity should re-evaluate service agreements periodically to determine whether they need to be updated.</p><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p><em>C. Oversight and Ongoing Monitoring</em></p></blockquote><p>The regulated entity should implement and oversee ongoing monitoring to ensure compliance with the service agreement(s) and to evaluate the performance of the cloud provider.&#160; The regulated entity should track all cloud providers used, the approved cloud services, and usage of those services.&#160; Each entity should assess each cloud provider’s quality and performance in providing information security to protect data at rest and in transit and evaluate the timeliness and completeness of the provider’s communications.</p><p>If the regulated entity relies on monitoring and oversight provided by third parties, such as third party audit reports, the regulated entity should evaluate whether its contracted cloud services match the services evaluated in the outsourced monitoring and oversight.<br></p><p><strong>III. Information Security</strong></p><p>Migrating operations to the cloud may result in both new information security risks, such as from multi-tenancy risks, and complications to existing information security risks, such as risks stemming from privileged user access.&#160; The regulated entity should evaluate and revise its information security program to reflect its cloud computing environments, and it should, to the extent possible, extend information security governance, engineering, architecture, and operations to cloud computing environments and providers.</p><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p><em>A. Shared Responsibility for Security</em></p></blockquote><p>The regulated entity and the cloud provider share responsibility for protecting data stored in the cloud.&#160; The regulated entity should understand its cloud security responsibilities, which may vary based on the provider and service model.&#160; In addition to any descriptions of the roles and responsibilities in the service agreement, the terms of the cloud provider’s information security standards and controls should inform the regulated entity of its responsibilities for protecting its cloud environment(s).&#160; The regulated entity should understand and mitigate, accept, or transfer the risks from any identified gaps in the cloud provider’s information security program.</p><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p><em>B. Data Classification and Systems Security</em></p></blockquote><p>The data classification and the regulated entity’s risk appetite should inform the security requirements of specific data in the cloud.&#160; Prior to placing data in a cloud environment, the regulated entity should evaluate the appropriateness of its protections, such as encryption, and geographic location of data at rest and in transit.&#160; The regulated entity should assess compliance with its security policies through regular tests of key controls, systems, and procedures it uses for its cloud environment(s).</p><p>The regulated entity should comply with laws and other requirements that may restrict where data are stored and establish appropriate data storage controls designed to maintain data in the appropriate physical location.&#160; Additionally, there are substantial legal and security risks to storing data outside the United States.&#160; The regulated entity should evaluate its risk appetite, the applicable jurisdiction’s laws, and the regulated entity’s expertise in and ability to effectively mitigate the security and legal risks prior to permitting hosting data in a jurisdiction outside of the United States.<br></p><p>The service and deployment model may also inform decisions about security requirements.&#160; For example, some cloud environments share physical components and resources among disparate tenants using logical separation of data.&#160; To protect against multi-tenancy risks, the regulated entity should ensure that it and the cloud provider take steps such as using information technology services and systems to monitor applicable activity within the cloud environment.<br></p><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p><em>C. Access Management</em></p></blockquote><p>Cloud computing environments may differ in access management configurations, so each regulated entity should take steps to ensure that identity and access management functions are configured properly.&#160; The regulated entity should evaluate the effectiveness of policies, procedures, and internal standards on identity and access management functions to protect against unauthorized or malicious use by the cloud provider.</p><p>The regulated entity should protect and secure cloud credentials.&#160; When encrypting data in the cloud, the regulated entity should protect and secure encryption keys in a manner consistent with the classification of the data they protect.​<br></p><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p><em>D. Incident Notification, Planning, and Response</em></p></blockquote><p>The regulated entity should update its incident response plan(s) to include incidents that could arise from using cloud providers.&#160; Responding to incidents that occur in the cloud environment often requires coordination with the cloud provider.&#160; Notification requirements in the service agreement should define the criticality of the incidents the cloud provider should report and require the cloud provider to deliver timely notification of such incidents with sufficient detail to allow the regulated entity to take steps to prevent the expansion of an incident, mitigate its effects, or eradicate the incident in accordance with its incident response plan.</p><blockquote style="margin&#58;0px 0px 0px 40px;border&#58;none;padding&#58;0px;"><p><em>E. Development and Testing Environments</em></p></blockquote><p>Regulated entities that isolate testing and development environments may maintain less rigorous controls over these environments to increase flexibility for developers and testers.&#160; The regulated entity should revisit and, as appropriate, update policies, procedures, and internal standards for development and testing on the cloud to assess whether it has sufficient controls to maintain security at all phases of the development life cycle.</p><p><strong>IV. Business Continuity Cloud Provider Management</strong></p><p>Cloud computing services may experience outages and performance slowdowns.&#160; The regulated entity should configure its cloud usage for a level of availability and reliability appropriate for its intended use.&#160; Using a cloud provider for disaster recovery does not relieve the regulated entity of its business continuity responsibilities.&#160; Business continuity scenarios and associated plans should evaluate a variety of scenarios, including permanent cloud provider failure, as well as a range of short- to long-term disruptions.&#160; The regulated entity should test, using an appropriate testing method, its business continuity plan both prior to, and while relying on, the cloud provider(s) for operations.</p><p>Each regulated entity should consider the risk of using the same cloud provider for multiple critical services.&#160; If an FHLBank plans to rely on another FHLBank (e.g., Buddy Bank) for business continuity and both use the same cloud provider, these arrangements should be re-evaluated for the possibility of a simultaneous disruption.<br><br></p><p><em style="text-decoration&#58;underline;"><strong>Related Guidance</strong></em></p><p><em>Information Security Management</em>, Federal Housing Finance Agency Advisory Bulletin 2017-02, September 28, 2017.</p><p><em>Internal Audit Governance and Function</em>, Federal Housing Finance Agency Advisory Bulletin 2016-05, October 7, 2016.<br></p><p><em>Data Management and Usage</em>, Federal Housing Finance Agency Advisory Bulletin 2016-04, September 29, 2016.<br></p><p><em>Information Technology Investment Management</em>, Federal Housing Finance Agency Advisory Bulletin 2015-06, September 21, 2015.<br><em>Model Risk Management</em>, Federal Housing Finance Agency Advisory Bulletin 2013-07, November 19, 2013.<br></p><p><em>Operational Risk Management</em>, Federal Housing Finance Agency Advisory Bulletin&#160;2014-02, February 18, 2014.&#160;</p><p>12 CFR Part 1236 Prudential Management and Operations Standards, Appendix.<br></p><p>​12 CFR Part 1239.11(a)(risk management program).<br></p><p><br></p><table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width&#58;100%;"><p>FHFA has statutory responsibility to ensure the safe and sound operations of the regulated entities and the Office of Finance.&#160; Advisory bulletins describe FHFA supervisory expectations for safe and sound operations in particular areas and are used in FHFA examinations of the regulated entities and the Office of Finance.&#160; Questions about this advisory bulletin should be directed to&#58; <a href="mailto&#58;SupervisionPolicy@fhfa.gov">SupervisionPolicy@fhfa.gov​</a>.<br></p></td></tr></tbody></table><br>8/15/2018 3:30:01 PMHome / Supervision & Regulation / Advisory Bulletins / Cloud Computing Risk Management Advisory Bulletin This advisory bulletin provides Federal Housing Finance Agency (FHFA 5291https://www.fhfa.gov/SupervisionRegulation/AdvisoryBulletins/Pages/Forms/AllItems.aspxhtmlFalseaspx

© 2020 Federal Housing Finance Agency